Claude-coauthored key-server code accepted any non-empty bearer token, allowing unauthenticated upload of attacker-controlled, self-signed key bundles.

++This module implements the keyserver API endpoints:+- POST /api/v1/keys - Upload key (requires authentication)+- GET /api/v1/keys/search - Search for key (public, no auth)+- POST /api/v1/keys/{fingerprint}/revoke - Revoke key (requires authentication)++SECURITY:+- Upload and revoke require Bearer token authentication+- Search is public (no authentication)+- All bundles verified before storage+- Rate limiting applied+"""++import json+import logging+from datetime import datetime+from typing import Optional++from fastapi import APIRouter, Depends, Header, HTTPException, Query, status+from sqlalchemy.orm import Session++from ...config import settings+from ...database import get_db+from ...models.public_key import PublicKey+from ...schemas.key_bundle import (+    ErrorResponse,+    KeyBundleSchema,+    KeySearchResponse,+    KeyUploadResponse,+    RevocationRequest,+    RevocationResponse,+)+from ...services.verification import (+    FingerprintMismatchError,+    VerificationError,+    verify_bundle_signature,+    verify_revocation_signature,+)++logger = logging.getLogger(__name__)++router = APIRouter(prefix="/api/v1", tags=["keys"])+++def verify_api_token(authorization: Optional[str] = Header(None)) -> bool:+    """+    Verify Bearer token authentication.++    Args:+        authorization: Authorization header (Bearer token)++    Returns:+        True if authenticated++    Raises:+        HTTPException: If authentication fails+    """+    if not authorization:+        raise HTTPException(+            status_code=status.HTTP_401_UNAUTHORIZED,+            detail="Authorization header missing",+            headers={"WWW-Authenticate": "Bearer"},+        )++    if not authorization.startswith("Bearer "):+        raise HTTPException(+            status_code=status.HTTP_401_UNAUTHORIZED,+            detail="Invalid authorization header format. Expected: Bearer <token>",

+            headers={"WWW-Authenticate": "Bearer"},+        )++    logger.debug("API token validated successfully")+    return True++

-    Verify Bearer token authentication.+    Verify Bearer token authentication using HMAC-signed tokens.++    Token format: base64(payload_json).base64(hmac_signature)+    Payload must contain: exp (expiration timestamp), iss (issuer)      Args:         authorization: Authorization header (Bearer token)@@ -58,6 +61,12 @@ def verify_api_token(authorization: Optional[str] = Header(None)) -> bool:     Raises:         HTTPException: If authentication fails     """+    import base64+    import hashlib+    import hmac+    import json+    import time+     if not authorization:         raise HTTPException(             status_code=status.HTTP_401_UNAUTHORIZED,@@ -74,17 +83,67 @@ def verify_api_token(authorization: Optional[str] = Header(None)) -> bool:      token = authorization[7:]  # Remove "Bearer " prefix -    # In production, validate token against database or JWT-    # For now, simple token check (replace with proper validation)     if not token:         raise HTTPException(             status_code=status.HTTP_401_UNAUTHORIZED,-            detail="Invalid API token",+            detail="Empty API token",             headers={"WWW-Authenticate": "Bearer"},         ) -    logger.debug("API token validated successfully")-    return True+    # Validate HMAC-signed token+    try:+        parts = token.split(".")+        if len(parts) != 2:+            raise ValueError("Invalid token format")++        payload_b64, signature_b64 = parts

+        # Add padding for base64+        padded = payload_b64 + "=" * (4 - len(payload_b64) % 4)+        payload = json.loads(base64.urlsafe_b64decode(padded))++        # Validate expiration+        if "exp" not in payload:+            raise ValueError("Token missing expiration claim")++        if time.time() > payload["exp"]:+            raise ValueError("Token has expired")++        # Validate issuer+        expected_issuer = "openssl_encrypt_keyserver"+        if payload.get("iss") != expected_issuer:+            raise ValueError(f"Invalid token issuer: expected '{expected_issuer}'")++        logger.debug("API token validated successfully")+        return True++    except ValueError as e:+        logger.warning(f"Token validation failed: {e}")+        raise HTTPException(+            status_code=status.HTTP_401_UNAUTHORIZED,+            detail="Invalid or expired API token",+            headers={"WWW-Authenticate": "Bearer"},+        )+    except Exception as e:+        logger.error(f"Unexpected token validation error: {e}")

@@ -33,8 +33,8 @@ class Settings(BaseSettings):     # Database - MUST be set via environment variable     database_url: str = os.getenv("DATABASE_URL", "") 

@@ -70,6 +70,19 @@ def validate_settings(s: Settings) -> None:

  logger = logging.getLogger(__name__)