akanealw
eec8c28fb3
Some checks failed
Go Benchmark / Performance Regression Check (push) Has been cancelled
Cerberus Integration / Cerberus Security Stack Integration (push) Has been cancelled
Upload Coverage to Codecov / Backend Codecov Upload (push) Has been cancelled
Upload Coverage to Codecov / Frontend Codecov Upload (push) Has been cancelled
CodeQL - Analyze / CodeQL analysis (go) (push) Has been cancelled
CodeQL - Analyze / CodeQL analysis (javascript-typescript) (push) Has been cancelled
CrowdSec Integration / CrowdSec Bouncer Integration (push) Has been cancelled
Docker Build, Publish & Test / build-and-push (push) Has been cancelled
Quality Checks / Auth Route Protection Contract (push) Has been cancelled
Quality Checks / Codecov Trigger/Comment Parity Guard (push) Has been cancelled
Quality Checks / Backend (Go) (push) Has been cancelled
Quality Checks / Frontend (React) (push) Has been cancelled
Rate Limit integration / Rate Limiting Integration (push) Has been cancelled
Security Scan (PR) / Trivy Binary Scan (push) Has been cancelled
Supply Chain Verification (PR) / Verify Supply Chain (push) Has been cancelled
WAF integration / Coraza WAF Integration (push) Has been cancelled
Docker Build, Publish & Test / Security Scan PR Image (push) Has been cancelled
Repo Health Check / Repo health (push) Has been cancelled
History Rewrite Dry-Run / Dry-run preview for history rewrite (push) Has been cancelled
Prune Renovate Branches / prune (push) Has been cancelled
Renovate / renovate (push) Has been cancelled
Nightly Build & Package / sync-development-to-nightly (push) Has been cancelled
Nightly Build & Package / Trigger Nightly Validation Workflows (push) Has been cancelled
Nightly Build & Package / build-and-push-nightly (push) Has been cancelled
Nightly Build & Package / test-nightly-image (push) Has been cancelled
Nightly Build & Package / verify-nightly-supply-chain (push) Has been cancelled
Update GeoLite2 Checksum / update-checksum (push) Has been cancelled
Container Registry Prune / prune-ghcr (push) Has been cancelled
Container Registry Prune / prune-dockerhub (push) Has been cancelled
Container Registry Prune / summarize (push) Has been cancelled
118 lines
2.8 KiB
Markdown
Executable File
118 lines
2.8 KiB
Markdown
Executable File
---
|
|
title: "Issue #365: Additional Security Enhancements - Manual Test Plan"
|
|
labels:
|
|
- manual-testing
|
|
- security
|
|
- testing
|
|
type: testing
|
|
priority: medium
|
|
parent_issue: 365
|
|
---
|
|
|
|
# Issue #365: Additional Security Enhancements - Manual Test Plan
|
|
|
|
**Issue**: <https://github.com/Wikid82/Charon/issues/365>
|
|
**PRs**: #436, #437
|
|
**Status**: Ready for Manual Testing
|
|
|
|
---
|
|
|
|
## Test Scenarios
|
|
|
|
### 1. Invite Token Security
|
|
|
|
**Objective**: Verify constant-time token comparison doesn't leak timing information.
|
|
|
|
**Steps**:
|
|
|
|
1. Create a new user invite via the admin UI
|
|
2. Copy the invite token from the generated link
|
|
3. Attempt to accept the invite with the correct token - should succeed
|
|
4. Attempt to accept with a token that differs only in the last character - should fail with same response time
|
|
5. Attempt to accept with a completely wrong token - should fail with same response time
|
|
|
|
**Expected**: Response times should be consistent regardless of where the token differs.
|
|
|
|
---
|
|
|
|
### 2. Security Headers Verification
|
|
|
|
**Objective**: Verify all security headers are present.
|
|
|
|
**Steps**:
|
|
|
|
1. Start Charon with HTTPS enabled
|
|
2. Use browser dev tools or curl to inspect response headers
|
|
3. Verify presence of:
|
|
- `Content-Security-Policy`
|
|
- `Strict-Transport-Security` (with preload)
|
|
- `X-Frame-Options: DENY`
|
|
- `X-Content-Type-Options: nosniff`
|
|
- `Referrer-Policy`
|
|
- `Permissions-Policy`
|
|
|
|
**curl command**:
|
|
|
|
```bash
|
|
curl -I https://your-charon-instance.com/
|
|
```
|
|
|
|
---
|
|
|
|
### 3. Container Hardening (Optional - Production)
|
|
|
|
**Objective**: Verify documented container hardening works.
|
|
|
|
**Steps**:
|
|
|
|
1. Deploy Charon using the hardened docker-compose config from docs/security.md
|
|
2. Verify container starts successfully with `read_only: true`
|
|
3. Verify all functionality works (proxy hosts, certificates, etc.)
|
|
4. Verify logs are written to tmpfs mount
|
|
|
|
---
|
|
|
|
### 4. Documentation Review
|
|
|
|
**Objective**: Verify all documentation is accurate and complete.
|
|
|
|
**Pages to Review**:
|
|
|
|
- [ ] `docs/security.md` - TLS, DNS, Container Hardening sections
|
|
- [ ] `docs/security-incident-response.md` - SIRP document
|
|
- [ ] `docs/getting-started.md` - Security Update Notifications section
|
|
|
|
**Check for**:
|
|
|
|
- Correct code examples
|
|
- Working links
|
|
- No typos or formatting issues
|
|
|
|
---
|
|
|
|
### 5. SBOM Generation (CI/CD)
|
|
|
|
**Objective**: Verify SBOM is generated on release builds.
|
|
|
|
**Steps**:
|
|
|
|
1. Push a commit to trigger a non-PR build
|
|
2. Check GitHub Actions workflow run
|
|
3. Verify "Generate SBOM" step completes successfully
|
|
4. Verify "Attest SBOM" step completes successfully
|
|
5. Verify attestation is visible in GitHub container registry
|
|
|
|
---
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] All test scenarios pass
|
|
- [ ] No regressions in existing functionality
|
|
- [ ] Documentation is accurate and helpful
|
|
|
|
---
|
|
|
|
**Tester**: ________________
|
|
**Date**: ________________
|
|
**Result**: [ ] PASS / [ ] FAIL
|