fix: session cookie weak signing
Massimo Melina committed
Dec 30, 2022 at 17:17 UTC
f87b5bc85ebcb8400a1935dfc62b283d0c4b1481
3 files changed
+7
-4
src/index.ts
+2
-1
@@ -16,10 +16,11 @@ import { adminApis } from './adminApis'
16
import { defineConfig } from './config'
17
import { ok } from 'assert'
18
import _ from 'lodash'
19
+import { randomId } from './misc'
20
21
ok(_.intersection(Object.keys(frontEndApis), Object.keys(adminApis)).length === 0) // they share same endpoints
22
22
-const keys = ['hfs-keys-test']
23
+const keys = process.env.COOKIE_SIGN_KEYS?.split(',') || [randomId(30)]
24
export const app = new Koa({ keys })
25
app.use(someSecurity)
26
.use(sessions(app))
src/misc.ts
+4
-3
@@ -48,9 +48,10 @@ export function getOrSet<T>(o: Record<string,T>, k:string, creator:()=>T): T {
48
: (o[k] = creator())
49
}
50
51
-export function randomId(len = 10) {
52
- // 10 chars is 51+bits, the max we can give. 8 is 41+bits
53
- if (len > 10) throw Error('bad length');
51
+// 10 chars is 51+bits, 8 is 41+bits
52
+export function randomId(len = 10): string {
53
+ if (len > 10)
54
+ return randomId(10) + randomId(len - 10)
55
return Math.random()
56
.toString(36)
57
.substring(2, 2+len)
todo.md
+1
@@ -3,6 +3,7 @@
3
- plugins' log, accessible in admin
4
- fix: cannot switch off https and switch on http at the same time
5
- fix: chrome is prompting to save credentials without username because of login's double-form
6
+- admin/monitor: show user-agent
7
- admin: check + update
8
- frontend: hide closer button on login dialog accessing a protected resource, as it's no use
9
- easier nat life