3 ms·

Have you checked if the secret path leaks in referrers?

• diarrhea 5y ago
  It doesn't seem so. Clicking a random link from inside the Vaultwarden webpage (which is never used anyway, in favor of the Bitwarden browser plugins) and following the requests in Firefox's Browser Console, no request has a Referer HTTP request header. Vaultwarden does not send the Referer header cross-origin: https://github.com/dani-garcia/vaultwarden/blob/920371929bc89f5000d26c55b834148b32c8058f/src/util.rs#L31 https://github.com/dani-garcia/vaultwarden/blob/920371929bc8... My home server uses Caddy and its JSON logs. These are incredibly easy to parse of course. Through the dynamic DNS solution I use (Docker image qmcgaw/ddns-updater), I have a list of all of my own IP addresses. Add to that others like my work's IPv4 block, and I get a collection of 'known', i.e. harmless IP addresses. Filtering these in a little pandas-based Python tool leaves all requests reaching the secret endpoint. Logs reach back around a week. Another tool 'enriches' each log entry with IP lookup info from ipinfo.io. Their free API tier is enough for my uses. That way, I can filter for request origin countries, hostnames, etc. The entire pipeline is automated, but triggered manually on-demand. So far, no hits from unknown IPs to the endpoint!
  • pronoiac 5y ago
    That's a good way to investigate; I would've pointed to a server I control and check the logs.