Rolled back cookie ip binding for now.
Ylian Saint-Hilaire committed
Sep 14, 2019 at 17:35 UTC
6b3487a1d834c2e4dc5e95c4fdf366b534098dc6
1 file changed
+3
-3
webserver.js
+3
-3
@@ -1390,7 +1390,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1390
req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request
1391
} else if (req.query.login && (obj.parent.loginCookieEncryptionKey != null)) {
1392
var loginCookie = obj.parent.decodeCookie(req.query.login, obj.parent.loginCookieEncryptionKey, 60); // 60 minute timeout
1393
- if ((loginCookie != null) && (loginCookie.ip != null) && (loginCookie.ip != cleanRemoteAddr(req.ip))) { loginCookie = null; } // If the cookie if binded to an IP address, check here.
1393
+ //if ((loginCookie != null) && (loginCookie.ip != null) && (loginCookie.ip != cleanRemoteAddr(req.ip))) { loginCookie = null; } // If the cookie if binded to an IP address, check here.
1394
if ((loginCookie != null) && (loginCookie.a == 3) && (loginCookie.u != null) && (loginCookie.u.split('/')[1] == domain.id)) {
1395
// If a login cookie was provided, setup the session here.
1396
parent.debug('web', 'handleRootRequestEx: cookie auth ok.');
@@ -3175,7 +3175,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3175
*/
3176
3177
// Check the session if bound to the external IP address
3178
- if ((req.session.ip != null) && (req.session.ip == cleanRemoteAddr(req.ip))) { req.session = {}; }
3178
+ //if ((req.session.ip != null) && (req.session.ip == cleanRemoteAddr(req.ip))) { req.session = {}; }
3179
3180
// Detect if this is a file sharing domain, if so, just share files.
3181
if ((domain != null) && (domain.share != null)) {
@@ -3376,7 +3376,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3376
// This is a encrypted cookie authentication
3377
var cookie = obj.parent.decodeCookie(req.query.auth, obj.parent.loginCookieEncryptionKey, 240); // Cookie with 4 hour timeout
3378
if ((cookie == null) && (obj.parent.multiServer != null)) { cookie = obj.parent.decodeCookie(req.query.auth, obj.parent.serverKey, 240); } // Try the server key
3379
- if ((cookie != null) && (cookie.ip != null) && (cookie.ip != cleanRemoteAddr(req.ip))) { cookie = null; } // If the cookie if binded to an IP address, check here.
3379
+ //if ((cookie != null) && (cookie.ip != null) && (cookie.ip != cleanRemoteAddr(req.ip))) { cookie = null; } // If the cookie if binded to an IP address, check here.
3380
if ((cookie != null) && (obj.users[cookie.userid]) && (cookie.domainid == domain.id)) {
3381
// Valid cookie, we are authenticated
3382
func(ws, req, domain, obj.users[cookie.userid], cookie);