qt/security: QtWebSocketBackend's three async control paths never stamp env.session, so shared register/attach/assign reach the server unauthenticated

[Yaraslaut]

Summary

QtWebSocketBackend::registerModelSharedAsync, attachModelAsync and assignPrimaryAsync build their control envelopes and encode them without env.session = _session;. Their synchronous counterparts all stamp it. Since the async path is the WASM path, a WASM client's shared registration, attach and primary assignment reach an authenticating server carrying a default-constructed session.

Verification status

Verified by reading both sides of each pair. Not exercised against a live authorizing server — no end-to-end reproduction, and I have not measured what a given IAuthorizer does with an empty context. Revision: origin/master adfe8e5f plus this branch's doc-only commits; src/qt/qt_websocket_backend.cpp.

grep -n "env.session = _session" src/qt/qt_websocket_backend.cpp → lines 143, 196, 329, 344, 354, 386, 419.

Mapping those against the function boundaries:

Method	Lines	Builds	Stamps session?
sendRegisterAsync (used by registerModelAsync)	190-211	makeRegister	yes (:196)
registerModelShared	321-333	makeRegisterShared	yes (:329)
attachModel	333-346	makeAttach	yes (:344)
assignPrimary	348-356	makeAssign	yes (:354)
registerModelSharedAsync	223-253	makeRegisterShared	no
attachModelAsync	256-289	makeAttach	no
assignPrimaryAsync	358-382	makeAssign	no

Each async body reads, in full: build env → set env.callId → wire::encode(env) → sendTextMessage. There is no session assignment anywhere between.

include/morph/net/socket_backend.hpp stamps every equivalent site (:143, 174, 196, 210, 222, 260), so this is a Qt-side omission rather than a deliberate protocol choice.

Why it matters

RemoteServer authenticates and authorizes from env.session:

• remote.hpp:617-620 — stampVerifiedPrincipal
• remote.hpp:1068 (register), :1157 (attach), :1232 (assign)

So on the async path those three verbs are evaluated against an empty session — an unauthenticated principal — while the identical synchronous verbs are not.

It also contradicts the documented contract in two places:

• qt_websocket_backend.hpp:412-416: "Installs the session stamped onto every control envelope this backend subsequently builds (register, registerShared, attach, assign, deregister)."
• docs/spec/core/backend.md:85 and :131-148 state it as a cross-backend rule: "Every wire-backed implementation stamps the session … onto these."

Scope note

assignPrimaryAsync additionally has no if (!_cfg.asyncRegistrationEnabled) return false; gate, unlike the other three async hooks (:164, :228, :262). An embedder that opted out of async registration still gets asynchronous assign. Undocumented; mentioning it because a fix here touches the same function.

What would change the verdict

• Close it if the omission is deliberate and the server is shown to re-derive the principal for these three verbs from connection state rather than the envelope — in which case the three doc sites above need correcting instead, and the synchronous stamps are redundant.
• Raise it by pointing a SigningAuthorizer-configured RemoteServer at a WASM/async client and showing a shared attach succeeding that the synchronous path would refuse. That is the test this needs and does not have.

[Yaraslaut]

Triage: triage: valid, bug, area: qt

Premise re-checked by reading both sides of each pair, not from the filing. grep -n "env.session = _session" src/qt/qt_websocket_backend.cpp → 143, 196, 329, 344, 354, 386, 419. Mapped against function boundaries: registerModelShared (:329), attachModel (:344) and assignPrimary (:354) each stamp immediately before encode. Their async counterparts — registerModelSharedAsync (223-253), attachModelAsync (256-289), assignPrimaryAsync (358-382) — each build the identical envelope with makeRegisterShared/makeAttach/makeAssign and encode it with no session assignment anywhere between. Confirmed by reading all six bodies in full.

Not a layering question. morph::net::SocketBackend stamps every equivalent site (:143, 174, 196, 210, 222, 260), so this is a Qt-side omission, not a protocol decision. Invariant 3 does not apply: nothing here is a value type reporting a fact and a layer deciding policy — the session is simply not attached.

Consequence traced, not assumed: stampVerifiedPrincipal (remote.hpp:617-620) and the register/attach/assign authorization sites (:1068, :1157, :1232) all read env.session, so a default-constructed session yields an empty principal on exactly those three verbs.

Severity is gated by opt-in, and that is worth stating. asyncRegistrationEnabled defaults to false (qt_websocket_backend.hpp:57), so the sync stamping path is what a default deployment uses. The exposure is the WASM configuration — which is also the one that cannot use the sync path at all.

Invariant 7 applies to the fix: a test that only asserts the stamp is present would pass if setSession were a no-op. It must drive an authorizing RemoteServer and show the async verb refused before the fix and admitted after.