40x faster requests when credentials in url (after first one)
Massimo Melina committed
Jan 12, 2024 at 19:50 UTC
32be64b0618cbc8fd6d0435f0bf7d6c774410d82
1 file changed
+11
-3
src/auth.ts
+11
-3
@@ -4,6 +4,8 @@ import { SRPParameters, SRPRoutines, SRPServerSession } from 'tssrp6a'
4
import { Context } from 'koa'
5
import { prepareState } from './middlewares'
6
import { srpClientPart } from './srp'
7
+import { getOrSet } from './cross'
8
+import { createHash } from 'node:crypto'
9
10
const srp6aNimbusRoutines = new SRPRoutines(new SRPParameters())
11
@@ -18,12 +20,18 @@ export async function srpStep1(account: Account) {
20
return { step1, salt, pubKey: String(step1.B) } // cast to string cause bigint can't be jsonized
21
}
22
23
+const cache: any = {}
24
export async function srpCheck(username: string, password: string) {
25
const account = getAccount(username)
26
if (!account?.srp || !password) return
24
- const { step1, salt, pubKey } = await srpStep1(account)
25
- const client = await srpClientPart(username, password, salt, pubKey)
26
- return await step1.step2(client.A, client.M1).then(() => account, () => {})
27
+ const k = createHash('sha256').update(username + password + account.srp).digest("hex")
28
+ const good = await getOrSet(cache, k, async () => {
29
+ const { step1, salt, pubKey } = await srpStep1(account)
30
+ const client = await srpClientPart(username, password, salt, pubKey)
31
+ setTimeout(() => delete cache[k], 60_000)
32
+ return step1.step2(client.A, client.M1).then(() => 1, () => 0)
33
+ })
34
+ return good ? account : undefined
35
}
36
37
export function getCurrentUsername(ctx: Context): string {