ston1th/docstore
1
1
Fork 0
Code Issues 3 Releases Activity

fix xsrf and added nonce

Browse source
This commit is contained in:
ston1th 2025-10-15 22:51:08 +02:00
commit 809627b538
208 changed files with 7166 additions and 4278 deletions
Download patch file Download diff file Expand all files Collapse all files

2
pkg/server/context.go
View file

@ -93,7 +93,7 @@ func (c *Context) Exec() {
c.Err = errors.New("template is nil")
return
}
c.Data.Token, c.Err = newXsrf(c.Token.RawSig()[:keySize])
c.Data.Token = newXsrf(c.Token.RawSig())
c.Data.Version = c.Srv.Config.Version
if c.Data.BodyTitle == "" {

6
pkg/server/server.go
View file

@ -79,11 +79,11 @@ func (s *HTTPServer) Start() (err error) {
if err != nil {
return
}
opts := []jwt.JWTOption{jwt.WithNonce(), jwt.WithBlacklist(s.DB)}
if s.Config.Secret != "" {
s.JWT, err = jwt.New(jwt.DefaultExpiry, s.DB, bytes.NewBufferString(s.Config.Secret))
} else {
s.JWT, err = jwt.New(jwt.DefaultExpiry, s.DB, nil)
opts = append(opts, jwt.WithSecret(bytes.NewBufferString(s.Config.Secret)))
}
s.JWT, err = jwt.New(opts...)
if err != nil {
return errors.New("server: " + err.Error())
}

43
pkg/server/xsrf.go
View file

@ -3,25 +3,28 @@
package server
import (
"crypto/hmac"
"crypto/rand"
"crypto/subtle"
"crypto/sha256"
"encoding/base64"
"git.giftfish.de/ston1th/jwt/v3"
)
const keySize = jwt.KeySize / 2
const (
keySize = 16
fullSize = keySize * 2
)
func genKey(size int) (b []byte, err error) {
b = make([]byte, size)
_, err = rand.Reader.Read(b)
func genKey(length int) (bytes []byte) {
bytes = make([]byte, length)
rand.Read(bytes)
return
}
func newXsrf(secret []byte) (s string, err error) {
rnd, err := genKey(keySize)
s = base64.RawURLEncoding.EncodeToString(append(rnd, xor(rnd, secret)...))
return
func newXsrf(secret []byte) string {
mac := hmac.New(sha256.New, secret)
rnd := genKey(keySize)
mac.Write(rnd)
return base64.RawURLEncoding.EncodeToString(append(rnd, mac.Sum(nil)[:keySize]...))
}
func checkXsrf(xsrf string, secret []byte) bool {
@ -29,20 +32,10 @@ func checkXsrf(xsrf string, secret []byte) bool {
if err != nil {
return false
}
if len(t) != jwt.KeySize {
if len(t) != fullSize {
return false
}
return subtle.ConstantTimeCompare(secret, xor(t[keySize:], t[:keySize])) == 1
}
func xor(a, b []byte) (c []byte) {
n := len(a)
if len(b) < n {
return nil
}
c = make([]byte, n)
for i := 0; i < n; i++ {
c[i] = a[i] ^ b[i]
}
return
mac := hmac.New(sha256.New, secret)
mac.Write(t[:keySize])
return hmac.Equal(t[keySize:], mac.Sum(nil)[:keySize])
}

6
pkg/server/xsrf_test.go
View file

@ -7,11 +7,11 @@ import (
)
func TestXsrf(t *testing.T) {
sec, _ := genKey(keySize)
sec := genKey(keySize)
if len(sec) != keySize {
t.Fatal("len(sec) != keySize")
}
xsrf, _ := newXsrf(sec)
xsrf := newXsrf(sec)
if xsrf == "" {
t.Fatal("xsrf is empty")
}
@ -24,7 +24,7 @@ func TestXsrf(t *testing.T) {
t.Fatal("invalid xsrf check succeeded")
}
rnd, _ := genKey(keySize)
rnd := genKey(keySize)
if checkXsrf(xsrf, rnd) {
t.Fatal("invalid xsrf check succeeded")
}