supabase-audit-auth-signup

注册流程审计

🔴 严重：必须渐进式更新文件

必须边执行边写入上下文文件，而不是等到最后才写入。

• 每次测试完成后，立即写入 .sb-pentest-context.json
• 每次测试之前和之后，都要记录到 .sb-pentest-audit.log
• 不要等到技能执行完毕后才更新文件
• 如果技能崩溃或中断，之前的所有发现都必须已经保存

不得违反此要求。未能渐进式写入属于严重错误。

此技能用于测试用户注册流程中的安全问题和错误配置。

何时使用此技能

• 验证注册是否受到适当限制
• 测试注册滥用途径
• 检查注册的速率限制
• 作为身份验证安全审计的一部分

前置条件

• 已准备好 Supabase URL 和 anon key
• 已完成身份验证配置审计（建议）

注册安全为何重要

开放注册可能导致：

风险	说明
垃圾账号	机器人创建虚假账号
资源滥用	滥用免费套餐
邮件垃圾信息	利用你的服务发送邮件
数据污染	数据库中出现虚假数据
攻击面	账号越多，攻击途径越多

执行的测试

测试	目的
注册可用性	注册是否开放？
邮箱验证	是否接受无效邮箱？
速率限制	能否创建大量账号？
一次性邮箱	是否拦截临时邮箱？
密码策略	接受哪些密码？
响应信息	泄露了哪些信息？

用法

基本注册测试

Test signup security on my Supabase project

检查特定方面

Test if disposable emails are blocked for signup

输出格式

═══════════════════════════════════════════════════════════
 SIGNUP FLOW AUDIT
═══════════════════════════════════════════════════════════

 Project: abc123def.supabase.co
 Endpoint: /auth/v1/signup

 ─────────────────────────────────────────────────────────
 Signup Availability
 ─────────────────────────────────────────────────────────

 Status: ✅ OPEN (Anyone can register)

 Test Result:
 POST /auth/v1/signup
 Body: {"email": "[email protected]", "password": "TestPass123!"}
 Response: 200 OK - Account created

 Assessment: Signup is publicly available.
             Review if this is intended.

 ─────────────────────────────────────────────────────────
 Email Validation
 ─────────────────────────────────────────────────────────

 Valid email formats:
 ├── [email protected]: ✅ Accepted (expected)
 ├── [email protected]: ✅ Accepted (expected)
 └── [email protected]: ✅ Accepted (expected)

 Invalid email formats:
 ├── user@: ❌ Rejected (good)
 ├── @domain.com: ❌ Rejected (good)
 ├── [email protected]: ❌ Rejected (good)
 └── not-an-email: ❌ Rejected (good)

 Disposable Email Test:
 ├── [email protected]: ✅ Accepted ← 🟠 P2
 ├── [email protected]: ✅ Accepted ← 🟠 P2
 └── [email protected]: ✅ Accepted ← 🟠 P2

 Finding: Disposable emails are not blocked.
 Risk: Users can create throwaway accounts.

 Recommendation: Consider using an email validation
 service or blocklist in your application logic.

 ─────────────────────────────────────────────────────────
 Password Policy
 ─────────────────────────────────────────────────────────

 Minimum Length Test:
 ├── "12345" (5 chars): ❌ Rejected
 ├── "123456" (6 chars): ✅ Accepted ← P2 Short
 └── "1234567890" (10 chars): ✅ Accepted

 Current Policy: Minimum 6 characters

 Weak Password Test:
 ├── "password": ✅ Accepted ← 🟠 P2
 ├── "123456": ✅ Accepted ← 🟠 P2
 ├── "qwerty123": ✅ Accepted ← 🟠 P2
 └── "letmein": ✅ Accepted ← 🟠 P2

 Finding: Common weak passwords are accepted.

 Recommendation:
 1. Increase minimum length to 8+ characters
 2. Consider password strength requirements
 3. Check against common password lists

 ─────────────────────────────────────────────────────────
 Rate Limiting
 ─────────────────────────────────────────────────────────

 Signup Rate Test (same IP):
 ├── Request 1: ✅ 200 OK
 ├── Request 2: ✅ 200 OK
 ├── Request 3: ✅ 200 OK
 ├── Request 4: ❌ 429 Too Many Requests
 └── Retry-After: 3600 seconds

 Rate Limit: 3 signups/hour per IP
 Assessment: ✅ Rate limiting is active (good)

 ─────────────────────────────────────────────────────────
 Information Disclosure
 ─────────────────────────────────────────────────────────

 Existing Email Test:
 POST /auth/v1/signup (with existing email)
 Response: "User already registered"

 Finding: 🟠 P2 - Response reveals email existence

 This allows:
 ├── Email enumeration attacks
 ├── Knowing if someone has an account
 └── Targeted phishing attempts

 Recommendation: Use generic message like
 "Check your email to continue" for both new
 and existing accounts.

 ─────────────────────────────────────────────────────────
 Email Confirmation
 ─────────────────────────────────────────────────────────

 Status: ❌ NOT REQUIRED (confirmed in auth-config)

 Test: Created account and checked session
 Result: User immediately authenticated without
         email confirmation.

 ─────────────────────────────────────────────────────────
 Summary
 ─────────────────────────────────────────────────────────

 Signup: Open to public
 Rate Limiting: ✅ Active (3/hour)
 Email Confirmation: ❌ Not required

 Findings:
 ├── P1: Email confirmation disabled
 ├── P2: Disposable emails accepted
 ├── P2: Weak passwords accepted
 └── P2: Email enumeration possible

 Security Score: 5/10

 Priority Actions:
 1. Enable email confirmation
 2. Strengthen password policy
 3. Consider disposable email blocking
 4. Use generic error messages

═══════════════════════════════════════════════════════════

测试详情

一次性邮箱检测

测试的常见一次性邮箱域名：

• mailinator.com
• tempmail.com
• guerrillamail.com
• 10minutemail.com
• throwaway.email

弱密码列表

测试的常见密码：

• password、password123
• 123456、12345678
• qwerty、qwerty123
• letmein、welcome
• admin、administrator

速率限制测试

Attempt 1: 200 OK
Attempt 2: 200 OK
Attempt 3: 200 OK
Attempt 4: 429 Too Many Requests

上下文输出

{
  "signup_audit": {
    "timestamp": "2025-01-31T13:00:00Z",
    "signup_open": true,
    "rate_limit": {
      "enabled": true,
      "limit": 3,
      "period": "hour"
    },
    "email_validation": {
      "basic_validation": true,
      "disposable_blocked": false
    },
    "password_policy": {
      "min_length": 6,
      "weak_passwords_blocked": false
    },
    "information_disclosure": {
      "email_enumeration": true
    },
    "findings": [
      {
        "severity": "P1",
        "issue": "Email confirmation disabled"
      },
      {
        "severity": "P2",
        "issue": "Disposable emails accepted"
      },
      {
        "severity": "P2",
        "issue": "Weak passwords accepted"
      },
      {
        "severity": "P2",
        "issue": "Email enumeration possible"
      }
    ]
  }
}

修复示例

拦截一次性邮箱

// In your signup handler or Edge Function
import { isDisposable } from 'email-validator-package';

if (isDisposable(email)) {
  throw new Error('Please use a permanent email address');
}

加强密码要求

// Custom password validation
function validatePassword(password: string): boolean {
  if (password.length < 8) return false;
  if (!/[A-Z]/.test(password)) return false;
  if (!/[a-z]/.test(password)) return false;
  if (!/[0-9]/.test(password)) return false;
  return true;
}

防止邮箱枚举

// Always return same message
async function signup(email, password) {
  try {
    await supabase.auth.signUp({ email, password });
  } catch (error) {
    // Don't reveal if email exists
  }
  return { message: 'Check your email to continue' };
}

限制注册

如果注册应仅限邀请：

// Use admin API to invite users
const { data, error } = await supabaseAdmin.auth.admin.inviteUserByEmail(
  '[email protected]'
);

// Or disable signup in dashboard and use:
const { data, error } = await supabaseAdmin.auth.admin.createUser({
  email: '[email protected]',
  email_confirm: true
});

必须：渐进式更新上下文文件

⚠️ 此技能必须在执行过程中渐进式更新跟踪文件，而不是等到最后才更新。

关键规则：边执行边写入

不要把所有写入操作留到最后。应按以下步骤执行：

1. 每次注册测试之前 → 将操作记录到 .sb-pentest-audit.log
2. 每发现一个漏洞之后 → 立即更新 .sb-pentest-context.json
3. 速率限制测试之后 → 立即记录结果

这样可以确保即使技能中断、崩溃或超时，之前的所有发现都能保留下来。

必需操作（渐进式）

1. 使用测试结果更新 .sb-pentest-context.json：

   {
     "signup_audit": {
       "timestamp": "...",
       "signup_open": true,
       "rate_limit": { ... },
       "findings": [ ... ]
     }
   }
   

2. 记录到 .sb-pentest-audit.log：

   [TIMESTAMP] [supabase-audit-auth-signup] [START] Testing signup security
   [TIMESTAMP] [supabase-audit-auth-signup] [FINDING] P2: Weak passwords accepted
   [TIMESTAMP] [supabase-audit-auth-signup] [CONTEXT_UPDATED] .sb-pentest-context.json updated
   

3. 如果文件不存在，写入前先创建文件。

不接受未更新上下文文件的情况。

必须：收集证据

📁 证据目录： .sb-pentest-evidence/05-auth-audit/signup-tests/

要创建的证据文件

文件	内容
signup-tests/open-signup.json	注册可用性测试
signup-tests/weak-password.json	弱密码接受测试
signup-tests/disposable-email.json	一次性邮箱测试
signup-tests/rate-limit.json	速率限制测试

证据格式

{
  "evidence_id": "AUTH-SIGNUP-001",
  "timestamp": "2025-01-31T10:55:00Z",
  "category": "auth-audit",
  "type": "signup_test",

  "tests": [
    {
      "test_name": "weak_password_acceptance",
      "severity": "P2",
      "request": {
        "method": "POST",
        "url": "https://abc123def.supabase.co/auth/v1/signup",
        "body": {"email": "[email protected]", "password": "123456"},
        "curl_command": "curl -X POST '$URL/auth/v1/signup' -H 'apikey: $ANON_KEY' -H 'Content-Type: application/json' -d '{\"email\": \"[email protected]\", \"password\": \"123456\"}'"
      },
      "response": {
        "status": 200,
        "message": "User created"
      },
      "result": "VULNERABLE",
      "impact": "Weak passwords (6 chars) accepted"
    },
    {
      "test_name": "disposable_email",
      "severity": "P2",
      "request": {
        "body": {"email": "[email protected]", "password": "Test123456!"}
      },
      "response": {
        "status": 200,
        "message": "User created"
      },
      "result": "VULNERABLE",
      "impact": "Disposable emails not blocked"
    }
  ]
}

相关技能

• supabase-audit-auth-config — 完整的身份验证配置
• supabase-audit-auth-users — 用户枚举测试
• supabase-audit-rls — 使用 RLS 保护用户数据