Switch browser cookie signature from SHA1 to SHA384.
Ylian Saint-Hilaire committed
Jul 11, 2022 at 11:11 UTC
626c490771399e5818a3c7d3d970c44402627330
2 files changed
+16
-6
webrelayserver.js
+7
-2
@@ -61,11 +61,16 @@ module.exports.CreateWebRelayServer = function (parent, db, args, certificates,
61
}
62
}
63
64
+ // Setup a keygrip instance with higher default security, default hash is SHA1, we want to bump that up with SHA384
65
+ // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
66
+ // If args.sessionkey is a string, use it as a single key, but args.sessionkey can also be used as an array of keys.
67
+ const keygrip = require('keygrip')((typeof obj.args.sessionkey == 'string') ? [obj.args.sessionkey] : obj.args.sessionkey, 'sha384', 'base64');
68
+
69
// Setup cookie session
65
- var sessionOptions = {
70
+ const sessionOptions = {
71
name: 'xid', // Recommended security practice to not use the default cookie name
72
httpOnly: true,
68
- keys: [args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
73
+ keys: keygrip,
74
secure: (args.tlsoffload == null), // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
75
sameSite: (args.sessionsamesite ? args.sessionsamesite : 'lax')
76
}
webserver.js
+9
-4
@@ -5759,15 +5759,20 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5759
}
5760
}
5761
5762
+ // Setup a keygrip instance with higher default security, default hash is SHA1, we want to bump that up with SHA384
5763
+ // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
5764
+ // If args.sessionkey is a string, use it as a single key, but args.sessionkey can also be used as an array of keys.
5765
+ const keygrip = require('keygrip')((typeof obj.args.sessionkey == 'string') ? [obj.args.sessionkey] : obj.args.sessionkey, 'sha384', 'base64');
5766
+
5767
// Setup the cookie session
5763
- var sessionOptions = {
5768
+ const sessionOptions = {
5769
name: 'xid', // Recommended security practice to not use the default cookie name
5770
httpOnly: true,
5766
- keys: [obj.args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
5771
+ keys: keygrip,
5772
secure: (obj.args.tlsoffload == null), // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
5773
sameSite: (obj.args.sessionsamesite ? obj.args.sessionsamesite : 'lax')
5774
}
5770
- if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60 * 1000); }
5775
+ if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60000); } // sessiontime is minutes
5776
obj.app.use(obj.session(sessionOptions));
5777
5778
// Handle all incoming web sockets, see if some need to be handled as web relays
@@ -6689,7 +6694,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6694
// No redirects allowed, fail here. This is important to make sure there is no redirect cascades
6695
res.sendStatus(404);
6696
} else {
6692
- // Request was made to a different host, redirect using the full URL so an HTTP cookie can be created on the other DNS name
6697
+ // Request was made to a different host, redirect using the full URL so an HTTP cookie can be created on the other DNS name.
6698
const httpport = ((args.aliasport != null) ? args.aliasport : args.port);
6699
res.redirect('https://' + selectedHost + ((httpport != 443) ? (':' + httpport) : '') + req.url + '&noredirect=1');
6700
}