Security hardening: Fix CORS bypass, session fixation, authorization bypass, and open redirect vulnerabilities

[Copilot]

Comprehensive security audit identified multiple critical vulnerabilities in authentication, authorization, and session management.

Critical Fixes

• WebSocket CORS bypass: Changed setAllowedOrigins("*") to whitelist matching REST API policy
• Session fixation: Regenerate session after OAuth authentication to prevent hijacking
• Authorization bypass: Verify actual Discord guild membership, not just session claims
• Open redirect: Validate OAuth state parameter format before constructing redirect URLs

Security Hardening

• Cookie security: SameSite=Lax, HttpOnly, conditional Secure flags
• Input validation: Exception handling for all Integer.parseInt() calls
• Performance: 5-minute membership cache to prevent Discord API rate limits

Key Changes

// Before: Any origin could connect
registry.addHandler(handler, "/ws").setAllowedOrigins("*");

// After: Whitelist only
registry.addHandler(handler, "/ws").setAllowedOrigins(
    "http://localhost:5173",
    "https://wolf.robothanzo.dev"
);

// Before: Only checked session data
public boolean hasAccess(long guildId) {
    return String.valueOf(guildId).equals(user.getGuildId());
}

// After: Verify actual membership with cache
public boolean hasAccess(long guildId) {
    if (!String.valueOf(guildId).equals(user.getGuildId())) return false;
    return cachedMembershipCheck(guildId, user.getUserId());
}

CodeQL scan: 0 vulnerabilities

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• jitpack.io
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED -XX:MaxMetaspaceSize=384m -XX:+HeapDumpOnOutOfMemoryError -Xms256m -Xmx512m -Dfile.encoding=UTF-8 (dns block)
  • Triggering command: /usr/lib/jvm/temurin-25-jdk-amd64/bin/java /usr/lib/jvm/temurin-25-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --enable-native-access=ALL-UNNAMED -XX:MaxMetaspaceSize=384m -XX:+HeapDumpOnOutOfMemoryError -Xms256m -Xmx512m (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)