gristlabs_grist-core/static/locales
Leslie H 24ce54b586
Improve session ID security (#1059)
Follow-up of #994. This PR revises the session ID generation logic to improve security in the absence of a secure session secret. It also adds a section in the admin panel "security" section to nag system admins when GRIST_SESSION_SECRET is not set.

Following is an excerpt from internal conversation.

TL;DR: Grist's current implementation generates semi-secure session IDs and uses a publicly known default signing key to sign them when the environment variable GRIST_SESSION_SECRET is not set. This PR generates cryptographically secure session IDs to dismiss security concerns around an insecure signing key, and encourages system admins to configure their own signing key anyway.

> The session secret is required by expressjs/session to sign its session IDs. It's designed as an extra protection against session hijacking by randomly guessing session IDs and hitting a valid one. While it is easy to encourage users to set a distinct session secret, this is unnecessary if session IDs are generated in a cryptographically secure way. As of now Grist uses version 4 UUIDs as session IDs (see app/server/lib/gristSessions.ts - it uses shortUUID.generate which invokes uuid.v4 under the hood). These contain 122 bits of entropy, technically insufficient to be considered cryptographically secure. In practice, this is never considered a real vulnerability. To compare, RSA2048 is still very commonly used in web servers, yet it only has 112 bits of security (>=128 bits = "secure", rule of thumb in cryptography). But for peace of mind I propose using crypto.getRandomValues to generate real 128-bit random values. This should render session ID signing unnecessary and hence dismiss security concerns around an insecure signing key.
2024-06-25 15:43:25 -04:00
..
ar.client.json Translated using Weblate (Arabic) 2023-11-13 06:05:37 +01:00
bg.client.json Translated using Weblate (Bulgarian) 2024-05-26 00:09:24 +02:00
cs.client.json Translated using Weblate (Czech) 2024-01-01 12:06:48 +00:00
de.client.json Translated using Weblate (German) 2024-06-25 07:09:26 +02:00
de.server.json add stub server.json files for new translations 2023-01-04 17:10:41 -05:00
en.client.json Improve session ID security (#1059) 2024-06-25 15:43:25 -04:00
en.server.json Split client and server translations, organize by filename 2022-10-13 12:04:29 +02:00
es.client.json Translated using Weblate (Spanish) 2024-06-25 07:09:25 +02:00
es.server.json add stub server.json files for new translations 2023-01-04 17:10:41 -05:00
fa.client.json Translated using Weblate (Persian) 2023-04-03 12:38:37 +02:00
fi.client.json Translated using Weblate (Finnish) 2024-02-25 16:02:02 +01:00
fr.client.json Translated using Weblate (French) 2024-06-01 10:09:25 +02:00
fr.server.json Make a good part of the app localizable and add French translations (#325) 2022-10-28 09:11:08 -07:00
it.client.json Translated using Weblate (Italian) 2024-05-19 17:01:56 +02:00
ja.client.json Translated using Weblate (Japanese) 2024-03-11 15:01:52 +01:00
nb_NO.client.json Translated using Weblate (Norwegian Bokmål) 2023-10-11 17:41:22 +02:00
nb_NO.server.json add stub server.json files for new translations 2023-01-04 17:10:41 -05:00
nl.client.json Translated using Weblate (Dutch) 2023-11-03 13:32:35 +01:00
pl.client.json Translated using Weblate (Polish) 2023-11-13 21:53:43 +00:00
pt_BR.client.json Translated using Weblate (Portuguese (Brazil)) 2024-06-25 07:09:25 +02:00
pt_BR.server.json add stub server.json files for new translations 2023-01-04 17:10:41 -05:00
pt.client.json Translated using Weblate (Portuguese) 2024-04-13 20:02:01 +02:00
ro.client.json Translated using Weblate (Romanian) 2024-06-04 12:09:15 +02:00
ru.client.json Translated using Weblate (Russian) 2024-06-04 12:09:15 +02:00
sk.client.json Translated using Weblate (Slovak) 2024-06-25 07:09:26 +02:00
sl.client.json Translated using Weblate (Slovenian) 2024-06-02 19:09:25 +00:00
th.client.json Added translation using Weblate (Thai) 2023-10-31 08:53:12 +00:00
uk.client.json Translated using Weblate (Ukrainian) 2023-11-18 21:00:33 +01:00
vi.client.json Translated using Weblate (Vietnamese) 2024-04-04 17:18:53 +02:00
zh_Hans.client.json Translated using Weblate (Chinese (Simplified)) 2024-05-07 10:07:13 +02:00
zh_Hant.client.json Renaming invalid resource file and adding simple check in tests for the future. (#930) 2024-04-10 10:32:41 -07:00