Removed auth data from websocket connection URL.

Ylian Saint-Hilaire committed Nov 3, 2021 at 18:52 UTC f71c326231d88e570cd357ac9cb292dc01df1255
3 files changed +48 -12
meshuser.js
+6
@@ -608,6 +608,12 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
608 // pass through to switch statement until refactoring complete
609
610 switch (command.action) {
611 + case 'urlargs':
612 + {
613 + console.log(req.query);
614 + console.log(command.args);
615 + break;
616 + }
617 case 'intersession':
618 {
619 // Sends data between sessions of the same user
public/scripts/meshcentral.js
+5 -2
@@ -23,9 +23,12 @@ var MeshServerCreateControl = function (domain, authCookie) {
23 if (obj.connectstate != 0) return;
24 obj.connectstate = 0;
25 var url = window.location.protocol.replace('http', 'ws') + '//' + window.location.host + domain + 'control.ashx' + (urlargs.key ? ('?key=' + urlargs.key) : '');
26 - if (obj.authCookie && (obj.authCookie != '')) { url += '?auth=' + obj.authCookie; }
26 + if (obj.authCookie && (obj.authCookie != '')) {
27 + url += '?moreargs=1'
28 + //url += '?auth=' + obj.authCookie;
29 + }
30 obj.socket = new WebSocket(url);
28 - obj.socket.onopen = function (e) { obj.connectstate = 1; }
31 + obj.socket.onopen = function (e) { obj.connectstate = 1; if (obj.authCookie && (obj.authCookie != '')) { obj.send({ 'action': 'urlargs', 'args': { 'auth': obj.authCookie } }); } }
32 obj.socket.onmessage = obj.xxOnMessage;
33 obj.socket.onclose = function(e) { obj.Stop(e.code); }
34 obj.xxStateChange(1, 0);
webserver.js
+37 -10
@@ -5713,18 +5713,20 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5713 obj.app.ws(url + 'webrelay.ashx', function (ws, req) { PerformWSSessionAuth(ws, req, false, handleRelayWebSocket); });
5714 obj.app.ws(url + 'webider.ashx', function (ws, req) { PerformWSSessionAuth(ws, req, false, function (ws1, req1, domain, user, cookie) { obj.meshIderHandler.CreateAmtIderSession(obj, obj.db, ws1, req1, obj.args, domain, user); }); });
5715 obj.app.ws(url + 'control.ashx', function (ws, req) {
5716 - const domain = getDomain(req);
5717 - if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { ws.close(); return; } // Check 3FA URL key
5718 - PerformWSSessionAuth(ws, req, true, function (ws1, req1, domain, user, cookie) {
5719 - if (user == null) { // User is not authenticated, perform inner server authentication
5720 - if (req.headers['x-meshauth'] === '*') {
5721 - PerformWSSessionInnerAuth(ws, req, domain, function (ws1, req1, domain, user) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); }); // User is authenticated
5716 + getWebsocketArgs(ws, req, function (ws, req) {
5717 + const domain = getDomain(req);
5718 + if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { ws.close(); return; } // Check 3FA URL key
5719 + PerformWSSessionAuth(ws, req, true, function (ws1, req1, domain, user, cookie) {
5720 + if (user == null) { // User is not authenticated, perform inner server authentication
5721 + if (req.headers['x-meshauth'] === '*') {
5722 + PerformWSSessionInnerAuth(ws, req, domain, function (ws1, req1, domain, user) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); }); // User is authenticated
5723 + } else {
5724 + try { ws.close(); } catch (ex) { } // user is not authenticated and inner authentication was not requested, disconnect now.
5725 + }
5726 } else {
5723 - try { ws.close(); } catch (ex) { } // user is not authenticated and inner authentication was not requested, disconnect now.
5727 + obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); // User is authenticated
5728 }
5725 - } else {
5726 - obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); // User is authenticated
5727 - }
5729 + });
5730 });
5731 });
5732 obj.app.ws(url + 'devicefile.ashx', function (ws, req) { obj.meshDeviceFileHandler.CreateMeshDeviceFile(obj, ws, null, req, domain); });
@@ -7727,5 +7729,30 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
7729 obj.badLoginTableLastClean = 0;
7730 }
7731
7732 + // Hold a websocket until additional arguments are provided within the socket.
7733 + // This is a generic function that can be used for any websocket to avoid passing arguments in the URL.
7734 + function getWebsocketArgs(ws, req, func) {
7735 + if (req.query.moreargs != '1') {
7736 + // No more arguments needed, pass the websocket thru
7737 + func(ws, req);
7738 + } else {
7739 + // More arguments are needed
7740 + delete req.query.moreargs;
7741 + const xfunc = function getWebsocketArgsEx(msg) {
7742 + var command = null;
7743 + try { command = JSON.parse(msg.toString('utf8')); } catch (e) { return; }
7744 + if ((command != null) && (command.action === 'urlargs') && (typeof command.args == 'object')) {
7745 + for (var i in command.args) { getWebsocketArgsEx.req.query[i] = command.args[i]; }
7746 + ws.removeEventListener('message', getWebsocketArgsEx);
7747 + getWebsocketArgsEx.func(getWebsocketArgsEx.ws, getWebsocketArgsEx.req);
7748 + }
7749 + }
7750 + xfunc.ws = ws;
7751 + xfunc.req = req;
7752 + xfunc.func = func;
7753 + ws.on('message', xfunc);
7754 + }
7755 + }
7756 +
7757 return obj;
7758 };