[PR #167] [MERGED] [security] Keep the account token off media downloads #169

New issue

Closed

opened 2026-10-13 19:48:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:48:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/167
Author: @Glitchy-Sheep
Created: 8/21/2026
Status: ✅ Merged
Merged: 8/21/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: fix/token-scope

📝 Commits (3)

7ee3861 fix: Sign image and audio urls like file urls
9dac809 fix: Keep account credentials off the download session
fdf68fe docs: Changelog the credential-scope fix

📊 Changes

8 files changed (+139 additions, -17 deletions)

View changed files

📝 CHANGELOG.md (+5 -0)
📝 boosty_downloader/application/di/app_environment.py (+29 -9)
📝 boosty_downloader/application/mappers/audio.py (+2 -2)
📝 boosty_downloader/application/mappers/image.py (+4 -2)
📝 boosty_downloader/application/mappers/post_mapper.py (+6 -2)
➕ test/e2e/credentials_scope_test.py (+65 -0)
📝 test/fixtures/single_post_domain.json (+2 -2)
📝 test/unit/mappers/post_mapper_test.py (+26 -0)

📄 Description

[security] Keep the account token off media downloads

Summary

One shared aiohttp session carried the Boosty Authorization header and cookies on every request - including media downloads from CDN and third-party video hosts (OK.ru). Only the API needs the credentials; media access is guarded by the signed query inside each url. Downloads now run on a separate credential-free session.

Why this is safe - measured, not assumed

A live access matrix on real paid posts (bare curl, no credentials):

Request	Image	File	Audio
Bare url	200	403	403
Url + signed query	200	200	200

The signature alone is sufficient for protected media - no cookies, no token
Audio and images did not carry the signature before this PR: paid audio survived only thanks to the shared session cookies. That is why the first commit signs image/audio urls like file urls - without it, the clean session would have broken paid audio
(A Boosty quirk surfaced on the way: the image CDN serves paid images without any check at all - not ours to fix)

Changes

signed_query reaches every media mapper (image/audio, files had it already); the domain golden pins the signature on all three kinds
AppEnvironment builds two sessions: authorized (API only, "Credentials live ONLY here") and a clean download session with the same timeouts/tracing/retries plus DummyCookieJar - it neither stores nor sends any cookie, so CDN redirects cannot attach anything
A wiring test through the real AppEnvironment: a local server asserts the API request arrives with Authorization + cookie and the media request arrives with neither

Verification

task check + task test green: 176 passed + 1 xfail
Live download of two real paid posts with the new build: image (real JPEG), 9 files including edge-case names, audio (real MP3) - all downloaded by the credential-free session
Changelog: two entries under a new Security section

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/167 **Author:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Created:** 8/21/2026 **Status:** ✅ Merged **Merged:** 8/21/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `fix/token-scope` --- ### 📝 Commits (3) - [`7ee3861`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/7ee3861349bffedbd5d1780d591aa67872ce7f92) fix: Sign image and audio urls like file urls - [`9dac809`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/9dac809f6f5d004499bc5ebbe89816c42221ef45) fix: Keep account credentials off the download session - [`fdf68fe`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/fdf68fe948f62478fb4ea95b7e315107c1f4edae) docs: Changelog the credential-scope fix ### 📊 Changes **8 files changed** (+139 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+5 -0) 📝 `boosty_downloader/application/di/app_environment.py` (+29 -9) 📝 `boosty_downloader/application/mappers/audio.py` (+2 -2) 📝 `boosty_downloader/application/mappers/image.py` (+4 -2) 📝 `boosty_downloader/application/mappers/post_mapper.py` (+6 -2) ➕ `test/e2e/credentials_scope_test.py` (+65 -0) 📝 `test/fixtures/single_post_domain.json` (+2 -2) 📝 `test/unit/mappers/post_mapper_test.py` (+26 -0) </details> ### 📄 Description # [security] Keep the account token off media downloads ## Summary One shared aiohttp session carried the Boosty `Authorization` header and cookies on **every** request - including media downloads from CDN and third-party video hosts (OK.ru). Only the API needs the credentials; media access is guarded by the signed query inside each url. Downloads now run on a separate credential-free session. ## Why this is safe - measured, not assumed A live access matrix on real **paid** posts (bare curl, no credentials): | Request | Image | File | Audio | |---|---|---|---| | Bare url | 200 | 403 | 403 | | Url + signed query | 200 | **200** | **200** | - The signature alone is sufficient for protected media - no cookies, no token - Audio and images did **not** carry the signature before this PR: paid audio survived only thanks to the shared session cookies. That is why the first commit signs image/audio urls like file urls - without it, the clean session would have broken paid audio - (A Boosty quirk surfaced on the way: the image CDN serves paid images without any check at all - not ours to fix) ## Changes 1. `signed_query` reaches every media mapper (image/audio, files had it already); the domain golden pins the signature on all three kinds 2. `AppEnvironment` builds two sessions: authorized (API only, "Credentials live ONLY here") and a clean download session with the same timeouts/tracing/retries plus `DummyCookieJar` - it neither stores nor sends any cookie, so CDN redirects cannot attach anything 3. A wiring test through the real `AppEnvironment`: a local server asserts the API request arrives with `Authorization` + cookie and the media request arrives with neither ## Verification - `task check` + `task test` green: **176 passed + 1 xfail** - Live download of two real paid posts with the new build: image (real JPEG), 9 files including edge-case names, audio (real MP3) - all downloaded by the credential-free session - Changelog: two entries under a new Security section --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 19:48:16 +00:00