Docker/planka
Docker/planka
1
0
Fork 0
mirror of https://github.com/plankanban/planka.git synced 2025-07-24 15:49:46 +02:00
Code Issues Releases Activity

feat: Additional httpOnly token for enhanced security in browsers

Browse source
This commit is contained in:
Maksim Eltyshev 2024-09-01 09:31:04 +02:00
parent 4176a62f1a
commit 9699fbe76a
18 changed files with 171 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

41
server/api/hooks/current-user/index.js
View file

@ -9,10 +9,10 @@
module.exports = function defineCurrentUserHook(sails) {
const TOKEN_PATTERN = /^Bearer /;
const getUser = async (accessToken) => {
const getSessionAndUser = async (accessToken, httpOnlyToken) => {
let payload;
try {
payload = sails.helpers.utils.verifyToken(accessToken);
payload = sails.helpers.utils.verifyJwtToken(accessToken);
} catch (error) {
return null;
}
@ -26,13 +26,20 @@ module.exports = function defineCurrentUserHook(sails) {
return null;
}
if (session.httpOnlyToken && httpOnlyToken !== session.httpOnlyToken) {
return null;
}
const user = await sails.helpers.users.getOne(payload.subject);
if (user && user.passwordChangedAt > payload.issuedAt) {
return null;
}
return user;
return {
session,
user,
};
};
return {
@ -52,17 +59,21 @@ module.exports = function defineCurrentUserHook(sails) {
if (authorizationHeader && TOKEN_PATTERN.test(authorizationHeader)) {
const accessToken = authorizationHeader.replace(TOKEN_PATTERN, '');
const currentUser = await getUser(accessToken);
const { httpOnlyToken } = req.cookies;
const sessionAndUser = await getSessionAndUser(accessToken, httpOnlyToken);
if (sessionAndUser) {
const { session, user } = sessionAndUser;
if (currentUser) {
Object.assign(req, {
accessToken,
currentUser,
currentSession: session,
currentUser: user,
});
if (req.isSocket) {
sails.sockets.join(req, `@accessToken:${accessToken}`);
sails.sockets.join(req, `@user:${currentUser.id}`);
sails.sockets.join(req, `@accessToken:${session.accessToken}`);
sails.sockets.join(req, `@user:${user.id}`);
}
}
}
@ -72,15 +83,17 @@ module.exports = function defineCurrentUserHook(sails) {
},
'/attachments/*': {
async fn(req, res, next) {
const { accessToken } = req.cookies;
const { accessToken, httpOnlyToken } = req.cookies;
if (accessToken) {
const currentUser = await getUser(accessToken);
const sessionAndUser = await getSessionAndUser(accessToken, httpOnlyToken);
if (sessionAndUser) {
const { session, user } = sessionAndUser;
if (currentUser) {
Object.assign(req, {
accessToken,
currentUser,
currentSession: session,
currentUser: user,
});
}
}

2
server/api/hooks/watcher/index.js
View file

@ -16,7 +16,7 @@ module.exports = function defineWatcherHook(sails) {
const accessToken = room.split(':')[1];
try {
sails.helpers.utils.verifyToken(accessToken);
sails.helpers.utils.verifyJwtToken(accessToken);
} catch (error) {
sails.sockets.broadcast(room, 'logout');
sails.sockets.leaveAll(room);