harden: a session (non-remembered) site connection cannot be revoked from the UI, and the remove-site message does nothing #406

New Issue

2026-09-21T20:37:56+02:00

clawbot commented

2026-09-21 20:37:56 +02:00

Severity: hardening.

Where. src/background/index.js:60 (connectedSites), 646-651 (a
non-remembered Allow only sets connectedSites), 1650-1653
(AUTISTMASK_REMOVE_SITE handler is a no-op); src/popup/views/settings.js:37-70
(Settings lists only remembered hostnames).

What is wrong. A site connected without "Remember" lives only in the
in-memory connectedSites map. Settings lists only remembered hostnames, so such
a connection is neither shown nor revocable, and the AUTISTMASK_REMOVE_SITE
message the popup sends on a remove does nothing in the background. A session
connection ends only on an address switch or a worker restart (and on Firefox's
persistent background page, not until the browser restarts).

Why it matters. The user cannot disconnect a site they connected, and
Settings gives an incomplete picture of who is connected.

Reproduction. Connect to a site without Remember; open Settings — the site is
not listed and there is no control to disconnect it.

Acceptable. Show live session connections in Settings, and make removal (and
AUTISTMASK_REMOVE_SITE) delete the matching connectedSites entries and
broadcast accountsChanged [] to that origin.

Definition of done.

Settings shows live session connections as well as remembered ones.
Removing a site clears both the remembered entry and any matching
connectedSites entry, and notifies the tab.
A test asserts a removed site no longer returns the address from
eth_accounts.

Related: #245

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: hardening. **Where.** `src/background/index.js:60` (`connectedSites`), `646-651` (a non-remembered Allow only sets `connectedSites`), `1650-1653` (`AUTISTMASK_REMOVE_SITE` handler is a no-op); `src/popup/views/settings.js:37-70` (Settings lists only remembered hostnames). **What is wrong.** A site connected without "Remember" lives only in the in-memory `connectedSites` map. Settings lists only remembered hostnames, so such a connection is neither shown nor revocable, and the `AUTISTMASK_REMOVE_SITE` message the popup sends on a remove does nothing in the background. A session connection ends only on an address switch or a worker restart (and on Firefox's persistent background page, not until the browser restarts). **Why it matters.** The user cannot disconnect a site they connected, and Settings gives an incomplete picture of who is connected. **Reproduction.** Connect to a site without Remember; open Settings — the site is not listed and there is no control to disconnect it. **Acceptable.** Show live session connections in Settings, and make removal (and `AUTISTMASK_REMOVE_SITE`) delete the matching `connectedSites` entries and broadcast `accountsChanged []` to that origin. **Definition of done.** - [ ] Settings shows live session connections as well as remembered ones. - [ ] Removing a site clears both the remembered entry and any matching `connectedSites` entry, and notifies the tab. - [ ] A test asserts a removed site no longer returns the address from `eth_accounts`. Related: https://git.eeqj.de/sneak/AutistMask/issues/245 Model: fable-5-1 (review); opus-4-8 (filing)

clawbot referenced this issue

2026-09-21 20:39:01 +02:00

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation #383

clawbot referenced this issue

2026-10-03 14:18:55 +02:00

harden: connectedSites is never cleared for a removed address or wallet #245

~~clawbot referenced this issue 2026-10-03 14:21:22 +02:00~~

Review toward 1.0: identify and file all next steps #382

clawbot referenced this issue

2026-10-04 03:00:56 +02:00

harden: end a site's unremembered connection when its address or wallet is removed #416

clawbot commented

2026-10-04 04:59:06 +02:00

Plan. One PR on a branch cut from next, base next, building on the removal message that #416 added.

Settings asks the background for the live session connections and lists them beside the remembered sites, each with the same remove control.
AUTISTMASK_REMOVE_SITE carries the site being removed; the background deletes every matching connectedSites entry and sends accountsChanged with an empty list to that site's tabs. Only the extension's own pages may send it.
Tests: after a remove, eth_accounts from that site returns no address, for a remembered and for a session connection; the Settings list shows a session connection.
Keep remembered sites keyed as they are today; #402 changes that key later.

Model: opus-5-5

Plan. One PR on a branch cut from `next`, base `next`, building on the removal message that https://git.eeqj.de/sneak/AutistMask/pulls/416 added. - Settings asks the background for the live session connections and lists them beside the remembered sites, each with the same remove control. - `AUTISTMASK_REMOVE_SITE` carries the site being removed; the background deletes every matching `connectedSites` entry and sends `accountsChanged` with an empty list to that site's tabs. Only the extension's own pages may send it. - Tests: after a remove, `eth_accounts` from that site returns no address, for a remembered and for a session connection; the Settings list shows a session connection. - Keep remembered sites keyed as they are today; https://git.eeqj.de/sneak/AutistMask/issues/402 changes that key later. Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-04 05:13:06 +02:00

harden: list and end site connections made without Remember in Settings (closes #406)

clawbot referenced a pull request that will close this issue

2026-10-04 06:07:36 +02:00

harden: list and end site connections made without Remember in Settings #419

clawbot commented

2026-10-04 06:07:42 +02:00

Built in #419: Settings now lists the sites allowed without "Remember" under Connected Sites. Removing a site from Allowed Sites or Connected Sites ends both kinds of connection for that hostname and sends its open tabs accountsChanged with an empty list.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/AutistMask/pulls/419: Settings now lists the sites allowed without "Remember" under Connected Sites. Removing a site from Allowed Sites or Connected Sites ends both kinds of connection for that hostname and sends its open tabs `accountsChanged` with an empty list. Model: opus-5-5

clawbot closed this issue

2026-10-04 06:41:42 +02:00

clawbot referenced this issue from a commit

2026-10-04 06:41:43 +02:00

harden: list and end site connections made without Remember in Settings (closes #406)

clawbot referenced this issue

2026-10-04 07:09:42 +02:00

fix: keep the flash line to its one line at any message length #420

Sign in to join this conversation.