rainbownapkin/canopy
1
0
Fork 0
Code Issues 2 Pull requests Actions Packages Projects Releases Wiki Activity

Remember me tokens now nuked upon full account logout.

Browse source
This commit is contained in:
rainbow napkin 2025-10-21 07:59:15 -04:00
parent 3fb71ffb78
commit bc0657a702
5 changed files with 26 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
src/controllers/api/account/loginController.js
View file

@ -39,7 +39,7 @@ module.exports.post = async function(req, res){
const data = matchedData(req);
//try to authenticate the session, throwing an error and breaking the current code block if user is un-authorized
await sessionUtils.authenticateSession(data.user, data.pass, req);
const userDB = await sessionUtils.authenticateSession(data.user, data.pass, req);
//If the user already has a remember me token
if(data.rememberme != null && data.rememberme.id != null){
@ -57,18 +57,21 @@ module.exports.post = async function(req, res){
//requires second DB call, but this enforces password requirement for toke generation while ensuring we only
//need one function in the userModel for authentication, even if the second woulda just been a wrapper.
//Less attack surface is less attack surface, and this isn't something thats going to be getting constantly called
const authToken = await rememberMeModel.genToken(data.user, data.pass);
const authToken = await rememberMeModel.genToken(userDB, data.pass);
//Check config for protocol
const secure = config.protocol.toLowerCase() == "https";
//If we properly authed
if(authToken != null){
//Check config for protocol
const secure = config.protocol.toLowerCase() == "https";
//Create expiration date for cookies (180 days)
const expires = new Date(Date.now() + (1000 * 60 * 60 * 24 * 180));
//Create expiration date for cookies (180 days)
const expires = new Date(Date.now() + (1000 * 60 * 60 * 24 * 180));
//Set remember me ID and token as browser-side cookies for safe-keeping
res.cookie("rememberme.id", authToken.id, {sameSite: 'strict', httpOnly: true, secure, expires});
//This should be the servers last interaction with the plaintext token before saving the hashed copy, and dropping it out of RAM
res.cookie("rememberme.token", authToken.token, {sameSite: 'strict', httpOnly: true, secure, expires});
//Set remember me ID and token as browser-side cookies for safe-keeping
res.cookie("rememberme.id", authToken.id, {sameSite: 'strict', httpOnly: true, secure, expires});
//This should be the servers last interaction with the plaintext token before saving the hashed copy, and dropping it out of RAM
res.cookie("rememberme.token", authToken.token, {sameSite: 'strict', httpOnly: true, secure, expires});
}
}
//Tell the browser everything is dandy

2
src/controllers/api/account/logoutController.js
View file

@ -34,7 +34,7 @@ module.exports.post = async function(req, res){
const data = matchedData(req);
//If the user has a remember me token id they've submitted with the request
if(data.rememberme.id){
if(data.rememberme != null && data.rememberme.id != null){
//Find the associated token and nuke it
await rememberMeModel.deleteOne({id: data.rememberme.id})
}

11
src/schemas/user/rememberMeSchema.js
View file

@ -27,7 +27,6 @@ const crypto = require("node:crypto");
const {mongoose} = require('mongoose');
//Local Imports
const {userModel} = require('./userSchema');
const hashUtil = require('../../utils/hashUtils');
const loggerUtils = require('../../utils/loggerUtils');
@ -88,9 +87,13 @@ rememberMeToken.methods.checkToken = async function(token){
}
//statics
rememberMeToken.statics.genToken = async function(user, pass){
//Authenticate user and pull document
const userDB = await userModel.authenticate(user, pass);
rememberMeToken.statics.genToken = async function(userDB, pass){
//Normally I'd use userModel auth, but this saves on DB calls and keeps us from having to refrence the userModel directly
//Saving us from circular depedency hell
//Plus this is only really getting called along-side other auth, theres already going to be an error message if this is wrong XP
if(!await userDB.checkPass(pass)){
return;
}
try{
//Generate a cryptographically secure string of 32 bytes in hexidecimal

4
src/schemas/user/userSchema.js
View file

@ -28,6 +28,7 @@ const permissionModel = require('../permissionSchema');
const emoteModel = require('../emoteSchema');
const emailChangeModel = require('./emailChangeSchema');
const playlistSchema = require('../channel/media/playlistSchema');
const rememberMeModel = require('./rememberMeSchema');
//Utils
const hashUtil = require('../../utils/hashUtils');
const mailUtil = require('../../utils/mailUtils');
@ -807,6 +808,9 @@ userSchema.methods.tattooIPRecord = async function(ip){
* @param {String} reason - Reason to kill user sessions
*/
userSchema.methods.killAllSessions = async function(reason = "A full log-out from all devices was requested for your account."){
//Nuke all related remember me tokens
await rememberMeModel.deleteMany({user: this._id});
//get authenticated sessions
var sessions = await this.getAuthenticatedSessions();

2
src/utils/sessionUtils.js
View file

@ -145,7 +145,7 @@ module.exports.authenticateSession = async function(identifier, secret, req, use
}
//return user
return userDB.user;
return userDB;
}catch(err){
//Failed attempts at good tokens are handled by the token schema by dropping the users effected tokens and screaming bloody murder
//Failed attempts with bad tokens don't need to be handled as it's not like attacking a bad UUID is going to get you anywhere anywho