NW-2Open
Sign one-click notice links with their own secret
The unsubscribe links in contributor notices are signed with the session secret itself.
No proposals yet. Be the first.
What and why
The one-click 'turn this off' links in contributor notices are an HMAC keyed by SESSION_SECRET, so rotating that secret breaks every link people already have. Sign them with their own secret (e.g. NOTICE_LINK_SECRET, defaulting to SESSION_SECRET) so SESSION_SECRET can rotate, and accept the previous secret for 60 days.
Done when
Acceptance criteriaLinks are signed with NOTICE_LINK_SECRET when set
A previous secret is accepted for 60 days, then refused
Tests cover rotation
Proposals 0
Open to read. Decline notes go only to the proposer.No proposals yet.
Discussion 0
Questions, updates and decisions live here.No posts yet. Ask a question before you propose.
to post or propose.