factor out kjol auth
This commit is contained in:
346
go/auth/authn.go
Normal file
346
go/auth/authn.go
Normal file
@@ -0,0 +1,346 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"kjol/security"
|
||||
)
|
||||
|
||||
// dummyHash is compared against when no user matches, so a login for an unknown
|
||||
// identifier costs the same bcrypt work as one for a known identifier with the
|
||||
// wrong password. Without it, response time alone would enumerate valid accounts.
|
||||
const dummyHash = "$2a$14$KW5OO1wZqGGq3SrpBFj0Oema5DG8Ph7lZJvq0ECkkYBpNFom6b9vO"
|
||||
|
||||
// maxLoginJitter bounds the random delay added to every login.
|
||||
const maxLoginJitter = 500 * time.Millisecond
|
||||
|
||||
// Login verifies an identifier and password and, on success, mints and persists
|
||||
// a session. It returns the resulting Principal and the raw session key, which
|
||||
// is the credential the caller hands to the client — as a cookie via
|
||||
// SetSessionCookie, or as a bearer token in a JSON response.
|
||||
//
|
||||
// Every failure path returns ErrInvalidCredentials: unknown identifier, wrong
|
||||
// password, and locked-out account are indistinguishable to the caller.
|
||||
func (a *Authenticator) Login(ctx context.Context, identifier, password string, meta SessionMeta) (Principal, string, error) {
|
||||
// Partial timing-attack mitigation: a uniform random delay on every attempt.
|
||||
//
|
||||
// This does not eliminate the timing signal — an attacker averaging enough
|
||||
// samples can still separate "user exists, bad password" from "no such user"
|
||||
// — but it raises the sample count needed by orders of magnitude, which is
|
||||
// what makes it effective in combination with the lockout below and
|
||||
// per-IP rate limiting at the edge.
|
||||
//
|
||||
// https://security.stackexchange.com/questions/96489/can-i-prevent-timing-attacks-with-random-delays/96493#96493
|
||||
jitter, err := rand.Int(rand.Reader, big.NewInt(int64(maxLoginJitter/time.Millisecond)))
|
||||
if err == nil {
|
||||
time.Sleep(time.Duration(jitter.Int64()) * time.Millisecond)
|
||||
}
|
||||
|
||||
user, err := a.dir.FindByIdentifier(ctx, identifier)
|
||||
lockedOut := a.cfg.MaxLoginAttempts > 0 && user.FailedLoginAttempts > a.cfg.MaxLoginAttempts
|
||||
|
||||
if err != nil || lockedOut {
|
||||
// Spend the same bcrypt time as the success path before bailing.
|
||||
security.ComparePasswords(password, dummyHash)
|
||||
return Principal{}, "", ErrInvalidCredentials
|
||||
}
|
||||
|
||||
if !security.ComparePasswords(password, user.PasswordHash) {
|
||||
// Best-effort: a failure to record the attempt must not grant access.
|
||||
_ = a.dir.RecordLoginResult(ctx, user, false)
|
||||
return Principal{}, "", ErrInvalidCredentials
|
||||
}
|
||||
|
||||
if err := a.dir.RecordLoginResult(ctx, user, true); err != nil {
|
||||
return Principal{}, "", fmt.Errorf("auth: record login: %w", err)
|
||||
}
|
||||
|
||||
return a.StartSession(ctx, user, meta)
|
||||
}
|
||||
|
||||
// StartSession mints, persists, and resolves permissions for a session for an
|
||||
// already-authenticated user. Login calls it after verifying a password; an app
|
||||
// calls it directly when a user proved themselves some other way (SSO callback,
|
||||
// an email magic link, impersonation by an admin).
|
||||
//
|
||||
// It returns the Principal and the raw session key.
|
||||
func (a *Authenticator) StartSession(ctx context.Context, user User, meta SessionMeta) (Principal, string, error) {
|
||||
key, err := security.GenerateRandomKeyBase64(a.cfg.KeyBytes)
|
||||
if err != nil {
|
||||
return Principal{}, "", fmt.Errorf("auth: generate session key: %w", err)
|
||||
}
|
||||
|
||||
now := time.Now()
|
||||
session := Session{
|
||||
// ID is intentionally left zero: the store (or its database default)
|
||||
// assigns it.
|
||||
Key: key,
|
||||
UserID: user.ID,
|
||||
OrgID: user.OrgID,
|
||||
Created: now,
|
||||
Expiration: now.Add(a.cfg.SessionTTL),
|
||||
Timezone: user.Timezone,
|
||||
IPAddr: meta.IPAddr,
|
||||
UserAgent: meta.UserAgent,
|
||||
}
|
||||
|
||||
if a.cfg.MaxActiveSessions > 0 {
|
||||
if err := a.store.EnforceSessionLimit(ctx, user.ID, a.cfg.MaxActiveSessions); err != nil {
|
||||
return Principal{}, "", fmt.Errorf("auth: enforce session limit: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
if err := a.store.Insert(ctx, session); err != nil {
|
||||
return Principal{}, "", fmt.Errorf("auth: insert session: %w", err)
|
||||
}
|
||||
|
||||
return Principal{
|
||||
Authenticated: true,
|
||||
Session: session,
|
||||
Permissions: a.resolvePermissions(ctx, session),
|
||||
}, key, nil
|
||||
}
|
||||
|
||||
// Logout revokes the session with the given key. Revoking an already-revoked or
|
||||
// unknown session is not an error.
|
||||
func (a *Authenticator) Logout(ctx context.Context, key string) error {
|
||||
if key == "" {
|
||||
return nil
|
||||
}
|
||||
if err := a.store.Revoke(ctx, key); err != nil {
|
||||
if errors.Is(err, ErrSessionNotFound) {
|
||||
return nil
|
||||
}
|
||||
return fmt.Errorf("auth: revoke session: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// SessionKeyFrom extracts the session key a request presents, preferring an
|
||||
// Authorization: Bearer token over the session cookie. It returns the key and
|
||||
// whether it came from a bearer token.
|
||||
func (a *Authenticator) SessionKeyFrom(r *http.Request) (key string, bearer bool) {
|
||||
if h := r.Header.Get("Authorization"); strings.HasPrefix(h, "Bearer ") {
|
||||
return strings.TrimPrefix(h, "Bearer "), true
|
||||
}
|
||||
if c, err := r.Cookie(a.cfg.CookieName); err == nil && c != nil {
|
||||
return c.Value, false
|
||||
}
|
||||
return "", false
|
||||
}
|
||||
|
||||
// LoadContext resolves the request's session and permissions and attaches the
|
||||
// Principal to its context. It is the outermost auth middleware; Require and
|
||||
// friends read what it attached.
|
||||
//
|
||||
// With requireAuth false, an unauthenticated request is served anyway, carrying
|
||||
// the zero Principal — for pages that render differently when signed in. With
|
||||
// requireAuth true, an unauthenticated request is rejected: JSON 401 for API and
|
||||
// bearer-token clients, a redirect to LoginPath for browsers (or a bare 401 when
|
||||
// Config.Redirect is false).
|
||||
func (a *Authenticator) LoadContext(h http.HandlerFunc, requireAuth bool) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
// Every one of these is per-request state. Hoisting any of it into the
|
||||
// enclosing closure would share it across concurrent requests on this
|
||||
// route: a single bearer-token request could then disable redirects for
|
||||
// every browser request that followed.
|
||||
key, bearer := a.SessionKeyFrom(r)
|
||||
wantsJSON := bearer || isAPIRequest(r)
|
||||
redirect := a.cfg.Redirect && !wantsJSON
|
||||
|
||||
session, err := a.lookupSession(r.Context(), key)
|
||||
if err != nil || !session.Valid() {
|
||||
expired := err == nil && !session.Revoked && session.Expired()
|
||||
a.rejectUnauthenticated(w, r, h, requireAuth, wantsJSON, redirect, expired)
|
||||
return
|
||||
}
|
||||
|
||||
principal := Principal{
|
||||
Authenticated: true,
|
||||
Session: session,
|
||||
Permissions: a.resolvePermissions(r.Context(), session),
|
||||
}
|
||||
|
||||
// An authenticated user asking for the login page gets sent home.
|
||||
if redirect && r.URL.Path == a.cfg.LoginPath {
|
||||
http.Redirect(w, r, a.cfg.DefaultPath, http.StatusFound)
|
||||
return
|
||||
}
|
||||
|
||||
h(w, withPrincipal(r, principal))
|
||||
}
|
||||
}
|
||||
|
||||
// lookupSession fetches the session for a key, treating an empty key as a miss
|
||||
// without troubling the store.
|
||||
func (a *Authenticator) lookupSession(ctx context.Context, key string) (Session, error) {
|
||||
if key == "" {
|
||||
return Session{}, ErrSessionNotFound
|
||||
}
|
||||
return a.store.FetchByKey(ctx, key)
|
||||
}
|
||||
|
||||
// rejectUnauthenticated handles a request with no usable session: serve it
|
||||
// anyway when auth is optional, otherwise reject in whichever dialect the client
|
||||
// speaks.
|
||||
func (a *Authenticator) rejectUnauthenticated(
|
||||
w http.ResponseWriter, r *http.Request, h http.HandlerFunc,
|
||||
requireAuth, wantsJSON, redirect, expired bool,
|
||||
) {
|
||||
if !requireAuth {
|
||||
h(w, withPrincipal(r, Principal{}))
|
||||
return
|
||||
}
|
||||
|
||||
if wantsJSON {
|
||||
reason := "valid authentication required"
|
||||
if expired {
|
||||
reason = "session expired"
|
||||
}
|
||||
respondJSONError(w, http.StatusUnauthorized, "Unauthorized: "+reason)
|
||||
return
|
||||
}
|
||||
|
||||
if expired {
|
||||
// The browser is holding a cookie that will never work again.
|
||||
a.ClearSessionCookie(w)
|
||||
}
|
||||
|
||||
// Don't bounce the login/logout pages back to themselves.
|
||||
if redirect && r.URL.Path != a.cfg.LoginPath && r.URL.Path != a.cfg.LogoutPath {
|
||||
http.Redirect(w, r, a.cfg.LoginPath+"?redirect="+url.QueryEscape(r.URL.String()), http.StatusFound)
|
||||
return
|
||||
}
|
||||
if !redirect && r.URL.Path != a.cfg.LoginPath {
|
||||
http.Error(w, "Error: Unauthorized", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
// Unauthenticated, on the login page itself: serve it.
|
||||
h(w, withPrincipal(r, Principal{}))
|
||||
}
|
||||
|
||||
// maxCookieBytes is the per-domain cookie budget browsers enforce.
|
||||
const maxCookieBytes = 4096
|
||||
|
||||
// SetSessionCookie writes the session key as the app's HttpOnly session cookie.
|
||||
// Use it for browser form logins; API clients get the raw key from Login instead.
|
||||
//
|
||||
// When remember is false the cookie is a session cookie: it dies with the
|
||||
// browser. When true it carries the session's own expiration.
|
||||
//
|
||||
// It fails rather than silently truncating if the domain's other cookies leave
|
||||
// no room — a session cookie that the browser drops would look like a login that
|
||||
// mysteriously does nothing.
|
||||
func (a *Authenticator) SetSessionCookie(w http.ResponseWriter, r *http.Request, p Principal, remember bool) error {
|
||||
var otherBytes int
|
||||
for _, c := range r.Cookies() {
|
||||
if c.Name != a.cfg.CookieName {
|
||||
otherBytes += len(c.Value)
|
||||
}
|
||||
}
|
||||
|
||||
// The 8 bytes are slack for cookie framing overhead.
|
||||
if len(p.Session.Key)+otherBytes+8 > maxCookieBytes {
|
||||
return fmt.Errorf("auth: cannot set session cookie, domain cookies exceed %d bytes", maxCookieBytes)
|
||||
}
|
||||
|
||||
cookie := &http.Cookie{
|
||||
Name: a.cfg.CookieName,
|
||||
Value: p.Session.Key,
|
||||
HttpOnly: true,
|
||||
Path: "/",
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
Secure: r.TLS != nil,
|
||||
}
|
||||
if remember {
|
||||
cookie.Expires = p.Session.Expiration
|
||||
}
|
||||
|
||||
http.SetCookie(w, cookie)
|
||||
return nil
|
||||
}
|
||||
|
||||
// ClearSessionCookie expires the session cookie in the client. It does not
|
||||
// revoke the session server-side — pair it with Logout.
|
||||
func (a *Authenticator) ClearSessionCookie(w http.ResponseWriter) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: a.cfg.CookieName,
|
||||
Value: "",
|
||||
MaxAge: -1,
|
||||
Expires: time.Unix(1, 0),
|
||||
Path: "/",
|
||||
})
|
||||
}
|
||||
|
||||
// HashAPIKey returns the digest under which an API key is stored and looked up.
|
||||
// Only the digest is ever persisted, so a leaked database yields no usable keys.
|
||||
func HashAPIKey(raw string) string {
|
||||
sum := sha256.Sum256([]byte(raw))
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
// LoadAPIKey authenticates a request with an organization-scoped API key from
|
||||
// Authorization: Bearer, and attaches an API-key Principal. It is the
|
||||
// non-interactive counterpart to LoadContext, for machine-facing endpoints.
|
||||
//
|
||||
// The Principal carries the key's org but no user and no permissions. Routes
|
||||
// mounted behind this middleware are therefore gated by the mount itself, not by
|
||||
// Require — which would deny them, there being no permissions to match.
|
||||
//
|
||||
// Requires Config.APIKeys; without it every request is rejected.
|
||||
func (a *Authenticator) LoadAPIKey(h http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
if a.cfg.APIKeys == nil {
|
||||
respondJSONError(w, http.StatusUnauthorized, "Unauthorized: API key authentication is not configured")
|
||||
return
|
||||
}
|
||||
|
||||
authHeader := r.Header.Get("Authorization")
|
||||
if !strings.HasPrefix(authHeader, "Bearer ") {
|
||||
respondJSONError(w, http.StatusUnauthorized, "Unauthorized: API key required")
|
||||
return
|
||||
}
|
||||
|
||||
key, err := a.cfg.APIKeys.FindAPIKeyByHash(r.Context(), HashAPIKey(strings.TrimPrefix(authHeader, "Bearer ")))
|
||||
if err != nil || key.Revoked {
|
||||
respondJSONError(w, http.StatusUnauthorized, "Unauthorized: invalid or revoked API key")
|
||||
return
|
||||
}
|
||||
|
||||
// Last-used is bookkeeping: don't make the caller wait on it, and don't
|
||||
// let the request's cancellation abort the write.
|
||||
go a.cfg.APIKeys.TouchAPIKey(context.WithoutCancel(r.Context()), key.ID)
|
||||
|
||||
h(w, withPrincipal(r, Principal{
|
||||
Authenticated: true,
|
||||
IsAPIKey: true,
|
||||
Session: Session{OrgID: &key.OrgID},
|
||||
Permissions: map[string]bool{},
|
||||
}))
|
||||
}
|
||||
}
|
||||
|
||||
// isAPIRequest reports whether a request should be answered in JSON rather than
|
||||
// with a redirect.
|
||||
func isAPIRequest(r *http.Request) bool {
|
||||
return strings.HasPrefix(r.URL.Path, "/api/")
|
||||
}
|
||||
|
||||
// respondJSONError writes a JSON error body. The message is engine-authored, so
|
||||
// it needs no escaping.
|
||||
func respondJSONError(w http.ResponseWriter, status int, message string) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(status)
|
||||
fmt.Fprintf(w, `{"error": %q}`, message)
|
||||
}
|
||||
Reference in New Issue
Block a user