Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix axon requests signature using metadata #1394

Merged
merged 5 commits into from
Jun 22, 2023
Merged

Conversation

unconst
Copy link
Contributor

@unconst unconst commented Jun 17, 2023

Fix checks signature of requester during every call to text_prompting forward synapse using the signature generated on GRPC TCP channel creation.

This removes the possibility for man in the middle attacks where a malicious actor is capable of spoofing the keys of network validators.

@unconst
Copy link
Contributor Author

unconst commented Jun 17, 2023

Honours goes to Adrianmares for the majority of this fix.

Copy link
Contributor

@ifrit98 ifrit98 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! This looks good to me.

Should we also update the int version also in the Auth Interceptor to 510?

if int(version) < 370:

@unconst
Copy link
Contributor Author

unconst commented Jun 17, 2023

Well throw that in a different PR @ifrit98

@ifrit98 ifrit98 self-requested a review June 17, 2023 23:54
@ifrit98 ifrit98 merged commit 015ec92 into master Jun 22, 2023
@camfairchild camfairchild mentioned this pull request Jul 4, 2023
@ifrit98 ifrit98 deleted the fix_axon_requests branch October 5, 2023 21:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants