Switch browser cookie signature from SHA1 to SHA384.

Ylian Saint-Hilaire committed Jul 11, 2022 at 11:11 UTC 626c490771399e5818a3c7d3d970c44402627330
2 files changed +16 -6
webrelayserver.js
+7 -2
@@ -61,11 +61,16 @@ module.exports.CreateWebRelayServer = function (parent, db, args, certificates,
61 }
62 }
63
64 + // Setup a keygrip instance with higher default security, default hash is SHA1, we want to bump that up with SHA384
65 + // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
66 + // If args.sessionkey is a string, use it as a single key, but args.sessionkey can also be used as an array of keys.
67 + const keygrip = require('keygrip')((typeof obj.args.sessionkey == 'string') ? [obj.args.sessionkey] : obj.args.sessionkey, 'sha384', 'base64');
68 +
69 // Setup cookie session
65 - var sessionOptions = {
70 + const sessionOptions = {
71 name: 'xid', // Recommended security practice to not use the default cookie name
72 httpOnly: true,
68 - keys: [args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
73 + keys: keygrip,
74 secure: (args.tlsoffload == null), // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
75 sameSite: (args.sessionsamesite ? args.sessionsamesite : 'lax')
76 }
webserver.js
+9 -4
@@ -5759,15 +5759,20 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5759 }
5760 }
5761
5762 + // Setup a keygrip instance with higher default security, default hash is SHA1, we want to bump that up with SHA384
5763 + // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
5764 + // If args.sessionkey is a string, use it as a single key, but args.sessionkey can also be used as an array of keys.
5765 + const keygrip = require('keygrip')((typeof obj.args.sessionkey == 'string') ? [obj.args.sessionkey] : obj.args.sessionkey, 'sha384', 'base64');
5766 +
5767 // Setup the cookie session
5763 - var sessionOptions = {
5768 + const sessionOptions = {
5769 name: 'xid', // Recommended security practice to not use the default cookie name
5770 httpOnly: true,
5766 - keys: [obj.args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
5771 + keys: keygrip,
5772 secure: (obj.args.tlsoffload == null), // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
5773 sameSite: (obj.args.sessionsamesite ? obj.args.sessionsamesite : 'lax')
5774 }
5770 - if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60 * 1000); }
5775 + if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60000); } // sessiontime is minutes
5776 obj.app.use(obj.session(sessionOptions));
5777
5778 // Handle all incoming web sockets, see if some need to be handled as web relays
@@ -6689,7 +6694,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6694 // No redirects allowed, fail here. This is important to make sure there is no redirect cascades
6695 res.sendStatus(404);
6696 } else {
6692 - // Request was made to a different host, redirect using the full URL so an HTTP cookie can be created on the other DNS name
6697 + // Request was made to a different host, redirect using the full URL so an HTTP cookie can be created on the other DNS name.
6698 const httpport = ((args.aliasport != null) ? args.aliasport : args.port);
6699 res.redirect('https://' + selectedHost + ((httpport != 443) ? (':' + httpport) : '') + req.url + '&noredirect=1');
6700 }