security: secretless deployments accept admin tokens forged with the empty-string HMAC key #291

Summary

When neither auth.jwt_secret nor auth.jwks_url is configured — the default deployments/compose/standalone.yaml quickstart posture — the JWT middleware verifies HMAC tokens against []byte(""). An empty HMAC key is a valid key, so anyone can mint {"role":"admin"} signed with the empty string, pass RequireAdmin, and reach /v1/admin/query (raw SQL), policy CRUD, schema, and DLQ. Secretless mode is documented and logged as "pure public / default_role only" — it is actually forgeable-admin.

This contradicts the startup WARN, several code comments, and (newly, on PR #290) the docs.

Root cause

internal/auth/auth.go:70-92:

keyFunc := func(t *jwt.Token) (any, error) {
    if jwks != nil { return jwks.Keyfunc(t) }
    if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok { return nil, jwt.ErrSignatureInvalid }
    return []byte(cfg.JWTSecret), nil   // cfg.JWTSecret == "" here → empty HMAC key
}
// validMethods = HS256/384/512 when jwks == nil

jwt.Parse with WithValidMethods(["HS256",...]) and an empty-key keyFunc accepts a token an attacker signed with "". Tokenless requests correctly fall to default_role; the hole is specifically a presented, forged token escalating past it.

Proof (golang-jwt v5.3.1, the pinned version)

Using the exact keyFunc + WithValidMethods shape from the middleware:

forge err: <nil>
verify err: <nil> | token.Valid: true
ACCEPTED with role: admin

(token = jwt.NewWithClaims(HS256, {"role":"admin","exp":9999999999}).SignedString([]byte("")))

Exposure

deployments/compose/standalone.yaml publishes 8080:8080, sets no WH_AUTH_JWT_SECRET, and mounts no config.yaml — so a default docker compose up of the quickstart is reachable-admin to anyone who can hit the port.

Recommended fix (needs security review — fail-closed invariant, AGENTS.md #7/#13)

In internal/auth.Middleware, when jwks == nil && cfg.JWTSecret == "", treat every presented token as unverifiable — route it through the existing bad-token path (records the token error → resolves to default_role → fail-loud 401 on a gated denial). Tokenless requests are unchanged, so no documented public flow breaks; secretless mode becomes genuinely "public, default_role only" as everything already claims.

After the code is fixed, these stale claims become true as written and can be closed out:

• code: internal/auth/auth.go:40-42, internal/config/config.go:119, the WARN at cmd/wavehouse/main.go:76, config.yaml, the comment in deployments/compose/standalone.yaml
• docs: docs/src/content/docs/access-control.md:43, configuration.md:81, getting-started.md:54,103, deployment.md:126 (all pre-existing; PR feat(docs): live-demo hero panel via @wavehouse/sdk #290 deliberately did not add a sixth — it removed the one new instance it had introduced and tracks the rest here)

Suggested hardening (separate)

Also warn/refuse at startup if default_role resolves to an admin-capable role, and consider rejecting the change-me-in-production placeholder in non-dev.

Found during the PR #290 docs-review gate; surfaced to the maintainer, who chose to track it here and keep the (unrelated) docs PR moving.