critical-interval-security-checker

Critical Interval Security Checker

Analyze code to identify security-critical time intervals and timing vulnerabilities that could compromise security.

Workflow

1. Identify Security-Critical Operations

Look for code that handles:

• Authentication: Login, logout, token generation
• Session management: Session creation, validation, expiration
• Password operations: Reset tokens, change requests
• Rate limiting: Login attempts, API calls, password resets
• Token operations: JWT, OAuth tokens, API keys
• MFA: OTP codes, push notifications, backup codes

2. Check for Common Vulnerabilities

See vulnerability_patterns.md for detailed patterns.

Critical checks:

• Missing expiration validation
• Excessive timeout values
• No rate limiting on sensitive endpoints
• Client-side only expiration checks
• Race conditions in expiration logic
• Hardcoded timeout values
• Inconsistent timeout enforcement
• Timezone handling issues
• Timing attack vulnerabilities

3. Use Automated Checker

Run the automated checker script:

# Check single file
python scripts/check_intervals.py path/to/file.py

# Check entire directory
python scripts/check_intervals.py src/

# Specify language
python scripts/check_intervals.py src/ --language python

The script detects:

• 🔴 Critical: JWT decode without verification, timing attacks
• 🟠 High: Missing expiration checks, no rate limiting
• 🟡 Medium: Excessive timeouts, inconsistent enforcement
• 🔵 Low: Hardcoded timeouts, magic numbers

4. Manual Code Review

For each security-critical operation, verify:

Expiration is set:

# Good: Expiration set
token_expiry = datetime.utcnow() + timedelta(hours=1)

Expiration is checked:

# Good: Expiration validated
if datetime.utcnow() > token_expiry:
    raise TokenExpiredError()

Timeout is reasonable:

# Good: 1-hour reset token
RESET_TOKEN_EXPIRY = timedelta(hours=1)

# Bad: 7-day reset token (too long!)
RESET_TOKEN_EXPIRY = timedelta(days=7)