gRPC hardening: warn/validate on non-loopback bind; guard future services with interceptor #165

New Issue

2026-07-27T02:39:30Z

KofTwentyTwo commented

2026-07-27 02:39:30 +00:00

(Migrated from github.com)

From the 1.A.2 security review (Minor + forward-looking):

NUNCIO_GRPC_ADDR is passed straight to TcpListener::bind with no check that it resolves to loopback; NUNCIO_GRPC_ADDR=0.0.0.0:9420 would silently expose the API on all interfaces (bounded by the 256-bit bearer token, so defense-in-depth). Reject or tracing::warn! when the resolved bind IP is non-loopback.
Auth is attached per-service via SystemServer::with_interceptor. When a second gRPC service is added later, it must get its own interceptor — add a guard/comment so no service can be mounted un-intercepted.

From the 1.A.2 security review (Minor + forward-looking): 1. `NUNCIO_GRPC_ADDR` is passed straight to TcpListener::bind with no check that it resolves to loopback; `NUNCIO_GRPC_ADDR=0.0.0.0:9420` would silently expose the API on all interfaces (bounded by the 256-bit bearer token, so defense-in-depth). Reject or tracing::warn! when the resolved bind IP is non-loopback. 2. Auth is attached per-service via SystemServer::with_interceptor. When a second gRPC service is added later, it must get its own interceptor — add a guard/comment so no service can be mounted un-intercepted.

KofTwentyTwo commented

2026-07-28 14:06:24 +00:00

(Migrated from github.com)

Superseded by #201 (M6) in the roadmap restructuring (milestones M1–M7). The replacement story carries the full, self-contained spec for a remote implementer. See docs/ROADMAP.md, docs/STORY-WORKFLOW.md, docs/HANDOFF.md.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#165