Security Hardening: Implement local token-based authentication for JetBrains Plugin IPC

[PierrePrevostAvenel]

Description

In src/serena/jetbrains/jetbrains_plugin_client.py, Serena communicates with the Serena JetBrains IDE plugin via unauthenticated local HTTP endpoints on 127.0.0.1 (over ports 27000-27020).
While this communication is restricted to localhost, local unauthenticated HTTP services can potentially be exposed to local cross-protocol or cross-origin interactions (e.g. unauthorized local processes or browser-based CSRF/DNS rebinding attacks accessing IDE capabilities such as /debugReplEval or /readFile).

Affected Component

• Client: src/serena/jetbrains/jetbrains_plugin_client.py (JetBrainsPluginClientManager, JetBrainsPluginClient)
• Server: Serena JetBrains IDE Plugin HTTP service

Impact

• Severity: Low (Defense-in-Depth / Hardening)
• CWE: CWE-306 (Missing Authentication for Critical Function)
• Without an authentication handshake or shared ephemeral secret token, any local process on the host can send arbitrary commands and evaluate expressions via the JetBrains plugin HTTP service.

Suggested Improvement

Implement a local shared secret / bearer token authentication mechanism:

1. When the JetBrains plugin initializes its HTTP server, generate an ephemeral session token written to a secure, user-restricted local file (e.g. ~/.serena/jb_auth_token with 0600 permissions).
2. Have JetBrainsPluginClient read this token and include an Authorization: Bearer <token> header in all HTTP requests sent to http://127.0.0.1:<port>.
3. Require the JetBrains plugin server to validate this header on incoming requests before processing IDE actions.