machina-auth 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ef95dc9a17c0abc2f72fd81cc6bc78ca5baea5a058fb8800087c0ab1753fa8f
-  data.tar.gz: 85e89ffab0def4950f3da9ad9513d0cca3475cd222af0cd7fa12f9c56a8e18f7
+  metadata.gz: 43343ff99400bd16b180b6df3091ec04b98808ee6f3109292fbdcc357289543c
+  data.tar.gz: bea7a1a87b91e44fbd9e2fafd4235e2083aa11160e93a5fbae79bb96edd0aa18
 SHA512:
-  metadata.gz: b58c5c91d1ca06f6d5d050f79e200c3c012473d262a2a5231c8cc3b3a2dc0c799b1f163dffb4963e243bfe2c8d5d915e87ac74db516a4f1f493cdb34c55510a4
-  data.tar.gz: 2e8113a5ccfef4f7a6c07bba04127e746256da82ba8f0d79d7529625e5cb92acf2ac621beffacf80f552923e1b7858aae65f4de243d67f1d0775dbc01e43710a
+  metadata.gz: 34ee949454a8421c955c5ba1c52f00ae768629747c305d989760bd40012c0e445bc6b3ce3181326284ad0b8fd942dea6197af2a95bc57e01a0ed845cfdcea351
+  data.tar.gz: b3d44a849ca3cd050ea7b85a393c922536d48065e9f0158d6a47f39cd44985b213d8d902f049df14274e2f8808ba184dd6ffc428606b971c5cf5c96a998cd085

data/app/controllers/machina/callbacks_controller.rb

@@ -6,11 +6,17 @@ module Machina
   # echoed back or the token is rejected (login-CSRF / session fixation).
   # The engine has no ApplicationController; Base is required for cookies.
   class CallbacksController < ActionController::Base # rubocop:disable Rails/ApplicationController
+    include Machina::ControllerHelpers
+
+    # Duplicate callbacks from the same browser (a double-submitted Console
+    # picker) arrive within seconds; the state stays valid this long after use.
+    STATE_GRACE_PERIOD = 1.minute
+
     def show
       return reject('missing token') if params[:token].blank?
-      return reject('state mismatch') unless valid_state?
+      return restart_handshake('state mismatch') unless valid_state?
 
-      cookies.delete(:machina_state)
+      extend_state_cookie
       reset_session
       store_session_cookie
       redirect_to safe_return_to
@@ -30,6 +36,23 @@ module Machina
       render plain: 'Invalid authentication callback', status: :unprocessable_content
     end
 
+    # A stale, overwritten or missing state proves nothing either way, so
+    # re-run the handshake with a fresh nonce instead of dead-ending.
+    def restart_handshake(reason)
+      Rails.logger.warn("[machina] Auth callback rejected: #{reason}; restarting handshake")
+      redirect_to Machina.authorize_url(return_to: safe_return_to, state: issue_state), allow_other_host: true
+    end
+
+    def extend_state_cookie
+      cookies.signed[:machina_state] = {
+        value: cookies.signed[:machina_state],
+        httponly: true,
+        same_site: :lax,
+        secure: Machina.secure_cookies?,
+        expires: STATE_GRACE_PERIOD
+      }
+    end
+
     def store_session_cookie
       cookies[:machina_session] = {
         value: params[:token],

data/lib/machina/controller_helpers.rb

@@ -50,7 +50,7 @@ module Machina
 
     private
 
-    # Mints the single-use CSRF state for the auth handshake. The value rides
+    # Mints the CSRF state for the auth handshake. The value rides
     # on the callback URL through Console; the callback rejects a redirect
     # whose state does not match this cookie.
     def issue_state

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '1.0.2'
+  VERSION = '1.1.0'
 end

data/spec/requests/machina/callbacks_spec.rb

@@ -29,10 +29,21 @@ RSpec.describe Machina::CallbacksController, type: :controller do
       expect(set_cookie).to match(/machina_session=.*httponly/i)
     end
 
-    it 'clears the state cookie' do
+    it 'keeps the state cookie so a duplicate callback still succeeds' do
       get :show, params: { token:, state: }
 
-      expect(response.cookies).to include('machina_state' => nil)
+      expect(response.cookies['machina_state']).to be_present
+    end
+
+    it 'accepts a repeated callback and stores the newest token' do
+      get :show, params: { token: 'ps_first', state: }
+      request.cookies['machina_state'] = response.cookies['machina_state']
+      request.cookies['machina_session'] = 'ps_first'
+
+      get :show, params: { token: 'ps_second', state:, return_to: '/dashboard' }
+
+      expect(response).to redirect_to('/dashboard')
+      expect(response.cookies['machina_session']).to eq('ps_second')
     end
 
     it 'resets the session on credential swap' do
@@ -77,38 +88,54 @@ RSpec.describe Machina::CallbacksController, type: :controller do
   end
 
   describe 'with an invalid state' do
-    it 'rejects a mismatched state' do
-      sign_state_cookie(state)
+    before { Machina.config.identity_callback_uri = 'http://localhost:3000/machina/callback' }
+
+    shared_examples 'restarts the handshake' do
+      it 'redirects to Console with a fresh state and no session cookie' do
+        expect(response).to redirect_to(%r{\Ahttps://machina\.example\.test/authorize\?redirect_to=})
+        expect(CGI.unescape(response.location)).to include('return_to=%2Fdashboard', 'state=')
+        expect(response.cookies['machina_state']).to be_present
+        expect(response.cookies['machina_session']).to be_nil
+      end
+    end
 
-      get :show, params: { token:, state: 'forged' }
+    context 'with a mismatched state' do
+      before do
+        sign_state_cookie(state)
+        get :show, params: { token:, state: 'forged', return_to: '/dashboard' }
+      end
 
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      include_examples 'restarts the handshake'
     end
 
-    it 'rejects a missing state param' do
-      sign_state_cookie(state)
+    context 'with a missing state param' do
+      before do
+        sign_state_cookie(state)
+        get :show, params: { token:, return_to: '/dashboard' }
+      end
 
-      get :show, params: { token: }
-
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      include_examples 'restarts the handshake'
     end
 
-    it 'rejects when no state cookie was issued' do
-      get :show, params: { token:, state: }
+    context 'when no state cookie was issued' do
+      before { get :show, params: { token:, state:, return_to: '/dashboard' } }
 
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      include_examples 'restarts the handshake'
     end
 
-    it 'rejects a tampered (unsigned) state cookie' do
-      request.cookies['machina_state'] = state
+    context 'with a tampered (unsigned) state cookie' do
+      before do
+        request.cookies['machina_state'] = state
+        get :show, params: { token:, state:, return_to: '/dashboard' }
+      end
 
-      get :show, params: { token:, state: }
+      include_examples 'restarts the handshake'
+    end
+
+    it 'does not reflect an unsafe return_to into the restarted handshake' do
+      get :show, params: { token:, state:, return_to: '//evil.example.com/' }
 
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      expect(CGI.unescape(response.location)).to include('return_to=%2F&').or include('return_to=%2F"')
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - ZAR