Improved http session handling, new account page
Ylian Saint-Hilaire committed
Aug 22, 2018 at 16:18 UTC
e3ed9bd3c2a1ed5f381c5d867285a43db4b6bb5d
6 files changed
+49
-32
meshcentral.js
+7
-8
@@ -79,7 +79,7 @@ function CreateMeshCentralServer(config, args) {
79
try { require('./pass').hash('test', function () { }); } catch (e) { console.log('Old version of node, must upgrade.'); return; } // TODO: Not sure if this test works or not.
80
81
// Check for invalid arguments
82
- var validArguments = ['_', 'notls', 'user', 'port', 'aliasport', 'mpsport', 'mpsaliasport', 'redirport', 'cert', 'mpscert', 'deletedomain', 'deletedefaultdomain', 'showall', 'showusers', 'shownodes', 'showmeshes', 'showevents', 'showpower', 'clearpower', 'showiplocations', 'help', 'exactports', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpsdebug', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbimport', 'selfupdate', 'tlsoffload', 'userallowedip', 'fastcert', 'swarmport', 'swarmdebug', 'logintoken', 'logintokenkey', 'logintokengen', 'logintokengen', 'mailtokengen', 'admin', 'unadmin'];
82
+ var validArguments = ['_', 'notls', 'user', 'port', 'aliasport', 'mpsport', 'mpsaliasport', 'redirport', 'cert', 'mpscert', 'deletedomain', 'deletedefaultdomain', 'showall', 'showusers', 'shownodes', 'showmeshes', 'showevents', 'showpower', 'clearpower', 'showiplocations', 'help', 'exactports', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpsdebug', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbimport', 'selfupdate', 'tlsoffload', 'userallowedip', 'fastcert', 'swarmport', 'swarmdebug', 'logintoken', 'logintokenkey', 'logintokengen', 'logintokengen', 'mailtokengen', 'admin', 'unadmin', 'sessionkey', 'sessiontime'];
83
for (var arg in obj.args) { obj.args[arg.toLocaleLowerCase()] = obj.args[arg]; if (validArguments.indexOf(arg.toLocaleLowerCase()) == -1) { console.log('Invalid argument "' + arg + '", use --help.'); return; } }
84
if (obj.args.mongodb == true) { console.log('Must specify: --mongodb [connectionstring] \r\nSee https://docs.mongodb.com/manual/reference/connection-string/ for MongoDB connection string.'); return; }
85
for (var i in obj.config.settings) { obj.args[i] = obj.config.settings[i]; } // Place all settings into arguments, arguments have already been placed into settings so arguments take precedence.
@@ -419,13 +419,12 @@ function CreateMeshCentralServer(config, args) {
419
// If the server is set to "nousers", allow only loopback unless IP filter is set
420
if ((obj.args.nousers == true) && (obj.args.userallowedip == null)) { obj.args.userallowedip = "::1,127.0.0.1"; }
421
422
- if (obj.args.secret) {
423
- // This secret is used to encrypt HTTP session information, if specified, user it.
424
- obj.webserver = require('./webserver.js').CreateWebServer(obj, obj.db, obj.args, obj.args.secret, obj.certificates);
425
- } else {
426
- // If the secret is not specified, generate a random number.
427
- obj.webserver = require('./webserver.js').CreateWebServer(obj, obj.db, obj.args, buf.toString('hex').toUpperCase(), obj.certificates);
428
- }
422
+ // Set the session length to 60 minutes if not set and set a random key if needed
423
+ if ((obj.args.sessiontime == null) || (typeof obj.args.sessiontime != 'number') || (obj.args.sessiontime < 1)) { obj.args.sessiontime = 60; }
424
+ if (!obj.args.sessionkey) { obj.args.sessionkey = buf.toString('hex').toUpperCase(); }
425
+
426
+ // Start eh web server and if needed, the redirection web server.
427
+ obj.webserver = require('./webserver.js').CreateWebServer(obj, obj.db, obj.args, obj.certificates);
428
if (obj.redirserver != null) { obj.redirserver.hookMainWebServer(obj.certificates); }
429
430
// Setup the Intel AMT event handler
package.json
+3
-2
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.1.9-k",
3
+ "version": "0.1.9-m",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
@@ -30,6 +30,7 @@
30
"body-parser": "^1.18.2",
31
"compression": "^1.7.1",
32
"connect-redis": "^3.3.3",
33
+ "cookie-session": "^2.0.0-beta.3",
34
"express": "^4.16.2",
35
"express-handlebars": "^3.0.0",
36
"express-session": "^1.15.6",
@@ -43,7 +44,7 @@
44
"xmldom": "^0.1.27",
45
"yauzl": "^2.9.1"
46
},
46
- "devDependencies": { },
47
+ "devDependencies": {},
48
"repository": {
49
"type": "git",
50
"url": "https://github.com/Ylianst/MeshCentral.git"
sample-config.json
+2
@@ -5,6 +5,8 @@
5
"_MongoDbCol": "meshcentral",
6
"_WANonly": true,
7
"_LANonly": true,
8
+ "_SessionTime": 30,
9
+ "_SessionKey": "MyReallySecretPassword",
10
"_Port": 443,
11
"_RedirPort": 80,
12
"_AllowLoginToken": true,
views/default.handlebars
+1
-1
@@ -5174,7 +5174,7 @@
5174
if (maxUsers > 0) {
5175
if (addHeader) { x += '<tr><td class=userTableHeader>Online Users'; addHeader = false; }
5176
x += addUserHtml(user, sessions);
5177
- maxUsers--;
5177
+ maxUsers--;
5178
} else {
5179
hiddenUsers++;
5180
}
views/login.handlebars
+20
-8
@@ -72,27 +72,27 @@
72
</div>
73
<table>
74
<tr>
75
- <td align=right width=100>Username:</td>
75
+ <td id="nuUser" align=right width=100>Username:</td>
76
<td><input id=ausername type=text name=username onchange=validateCreate(1) maxlength=64 onkeydown=haltReturn(event) onkeyup=validateCreate(1,event) /></td>
77
</tr>
78
<tr>
79
- <td align=right width=100>Email:</td>
79
+ <td id="nuEmail" align=right width=100>Email:</td>
80
<td><input id=aemail type=text name=email onchange=validateCreate(2) maxlength=256 onkeydown=haltReturn(event) onkeyup=validateCreate(2,event) /></td>
81
</tr>
82
<tr>
83
- <td align=right>Password:</td>
83
+ <td id="nuPass1" align=right>Password:</td>
84
<td><input id=apassword1 type=password name=password1 autocomplete=off maxlength=256 onkeydown=haltReturn(event) onchange=validateCreate(3) onkeyup=validateCreate(3,event) /></td>
85
</tr>
86
<tr>
87
- <td align=right>Password:</td>
87
+ <td id="nuPass2" align=right>Password:</td>
88
<td><input id=apassword2 type=password name=password2 autocomplete=off maxlength=256 onkeydown=haltReturn(event) onchange=validateCreate(4) onkeyup=validateCreate(4,event) /></td>
89
</tr>
90
<tr>
91
- <td align=right>Password Hint:</td>
91
+ <td id="nuHint" align=right>Password Hint:</td>
92
<td><input id=apasswordhint type=text name=apasswordhint autocomplete=off maxlength=256 onkeydown=haltReturn(event) onchange=validateCreate(5) onkeyup=validateCreate(5,event) /></td>
93
</tr>
94
<tr id=newAccountPass title="Enter the account creation token">
95
- <td align=right>Creation Token:</td>
95
+ <td id="nuToken" align=right>Creation Token:</td>
96
<td><input id=anewaccountpass type=password name=anewaccountpass autocomplete=off maxlength=256 onkeydown=haltReturn(event) onchange=validateCreate(6) onkeyup=validateCreate(6,event) /></td>
97
</tr>
98
<tr>
@@ -224,8 +224,20 @@
224
225
function validateCreate(box,e) {
226
setDialogMode(0);
227
- var ok = ((Q('ausername').value.length > 0) && (Q('ausername').value.indexOf(' ') == -1) && (validateEmail(Q('aemail').value) == true) && (Q('apassword1').value.length > 0) && (Q('apassword2').value == Q('apassword1').value));
228
- if ((newAccountPass == 1) && (Q('anewaccountpass').value.length == 0)) { ok = false; }
227
+ var userok = (Q('ausername').value.length > 0) && (Q('ausername').value.indexOf(' ') == -1);
228
+ var emailok = (validateEmail(Q('aemail').value) == true);
229
+ var pass1ok = (Q('apassword1').value.length > 0);
230
+ var pass2ok = (Q('apassword2').value.length > 0) && (Q('apassword2').value == Q('apassword1').value);
231
+ var newAccOk = (newAccountPass == 0) || (Q('anewaccountpass').value.length > 0);
232
+ var ok = (userok && emailok && pass1ok && pass2ok && newAccOk);
233
+
234
+ // Color the fields
235
+ QS('nuUser').color = userok?'black':'#7b241c';
236
+ QS('nuEmail').color = emailok?'black':'#7b241c';
237
+ QS('nuPass1').color = pass1ok?'black':'#7b241c';
238
+ QS('nuPass2').color = pass2ok?'black':'#7b241c';
239
+ QS('nuToken').color = newAccOk?'black':'#7b241c';
240
+
241
QE('createButton', ok);
242
if (Q('apassword1').value == '') {
243
QH('passWarning', '');
webserver.js
+16
-13
@@ -36,7 +36,7 @@ if (!String.prototype.startsWith) { String.prototype.startsWith = function (sear
36
if (!String.prototype.endsWith) { String.prototype.endsWith = function (searchString, position) { var subjectString = this.toString(); if (typeof position !== 'number' || !isFinite(position) || Math.floor(position) !== position || position > subjectString.length) { position = subjectString.length; } position -= searchString.length; var lastIndex = subjectString.lastIndexOf(searchString, position); return lastIndex !== -1 && lastIndex === position; }; }
37
38
// Construct a HTTP web server object
39
-module.exports.CreateWebServer = function (parent, db, args, secret, certificates) {
39
+module.exports.CreateWebServer = function (parent, db, args, certificates) {
40
var obj = {};
41
42
// Modules
@@ -46,7 +46,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
46
obj.path = require('path');
47
obj.constants = require('constants');
48
obj.bodyParser = require('body-parser');
49
- obj.session = require('express-session');
49
+ obj.session = require('cookie-session');
50
obj.exphbs = require('express-handlebars');
51
obj.crypto = require('crypto');
52
obj.common = require('./common.js');
@@ -154,9 +154,11 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
154
obj.app.set('view engine', 'handlebars');
155
obj.app.use(obj.bodyParser.urlencoded({ extended: false }));
156
obj.app.use(obj.session({
157
- resave: false, // don't save session if unmodified
158
- saveUninitialized: false, // don't create session until something stored
159
- secret: secret // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
157
+ name: 'xid', // Recommanded security practice to not use the default cookie name
158
+ httpOnly: true,
159
+ keys: [ obj.args.sessionkey ], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
160
+ secure: (obj.args.notls != true), // Use this cookie only over TLS
161
+ maxAge: (obj.args.sessiontime * 60 * 1000) // 24 hours
162
}));
163
164
// Session-persisted message middleware
@@ -290,9 +292,8 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
292
var user = obj.users[req.session.userid]
293
obj.parent.DispatchEvent(['*'], obj, { etype: 'user', username: user.name, action: 'logout', msg: 'Account logout', domain: domain.id })
294
}
293
- req.session.destroy(function () {
294
- res.redirect(domain.url);
295
- });
295
+ req.session = null;
296
+ res.redirect(domain.url);
297
}
298
299
function handleLoginRequest(req, res) {
@@ -306,8 +307,9 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
307
user.login = Date.now();
308
obj.db.SetUser(user);
309
310
+
311
// Regenerate session when signing in to prevent fixation
310
- req.session.regenerate(function () {
312
+ //req.session.regenerate(function () {
313
// Store the user's primary key in the session store to be retrieved, or in this case the entire user object
314
// req.session.success = 'Authenticated as ' + user.name + 'click to <a href="/logout">logout</a>. You may now access <a href="/restricted">/restricted</a>.';
315
delete req.session.loginmode;
@@ -334,7 +336,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
336
} else {
337
res.redirect(domain.url);
338
}
337
- });
339
+ //});
340
341
obj.parent.DispatchEvent(['*'], obj, { etype: 'user', username: user.name, action: 'login', msg: 'Account login', domain: domain.id })
342
} else {
@@ -569,7 +571,8 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
571
// Remove the user
572
obj.db.Remove(user._id);
573
delete obj.users[user._id];
572
- req.session.destroy(function () { res.redirect(domain.url); });
574
+ req.session = null;
575
+ res.redirect(domain.url);
576
obj.parent.DispatchEvent(['*', 'server-users'], obj, { etype: 'user', username: user.name, action: 'accountremove', msg: 'Account removed', domain: domain.id })
577
} else {
578
res.redirect(domain.url);
@@ -679,7 +682,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
682
683
// If a user is logged in, serve the default app, otherwise server the login app.
684
if (req.session && req.session.userid) {
682
- if (req.session.domainid != domain.id) { req.session.destroy(function () { res.redirect(domain.url); }); return; } // Check is the session is for the correct domain
685
+ if (req.session.domainid != domain.id) { req.session = null; res.redirect(domain.url); return; } // Check is the session is for the correct domain
686
var viewmode = 1;
687
if (req.session.viewmode) {
688
viewmode = req.session.viewmode;
@@ -751,7 +754,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
754
if (domain == null) return;
755
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
756
if (req.session && req.session.userid) {
754
- if (req.session.domainid != domain.id) { req.session.destroy(function () { res.redirect(domain.url); }); return; } // Check is the session is for the correct domain
757
+ if (req.session.domainid != domain.id) { req.session = null; res.redirect(domain.url); return; } // Check is the session is for the correct domain
758
var user = obj.users[req.session.userid];
759
res.render(obj.path.join(__dirname, isMobileBrowser(req) ? 'views/terms-mobile' : 'views/terms'), { title: domain.title, title2: domain.title2, logoutControl: 'Welcome ' + user.name + '. <a href=' + domain.url + 'logout?' + Math.random() + ' style=color:white>Logout</a>' });
760
} else {