rodauth 2.46.0 → 2.48.0

data/lib/rodauth/features/jwt_cors.rb

@@ -8,6 +8,7 @@ module Rodauth
     auth_value_method :jwt_cors_allow_methods, 'POST'
     auth_value_method :jwt_cors_allow_headers, 'Content-Type, Authorization, Accept'
     auth_value_method :jwt_cors_expose_headers, 'Authorization'
+    auth_value_method :jwt_cors_vary_header, 'Origin'
     auth_value_method :jwt_cors_max_age, 86400
 
     auth_methods(:jwt_cors_allow?)
@@ -33,6 +34,7 @@ module Rodauth
 
     def before_rodauth
       if jwt_cors_allow?
+        set_response_header('vary', jwt_cors_vary_header)
         set_response_header('access-control-allow-origin', request.env['HTTP_ORIGIN'])
 
         # Handle CORS preflight request

data/lib/rodauth/features/jwt_refresh.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   Feature.define(:jwt_refresh, :JwtRefresh) do
-    depends :jwt
+    depends :jwt, :require_hmac_secret
 
     after 'refresh_token'
     before 'refresh_token'
@@ -31,28 +31,34 @@ module Rodauth
       :account_from_refresh_token
     )
 
-    uses_instance_variables(:@jwt_refresh_route)
+    uses_instance_variables(
+      :@jwt_refresh_route,
+      :@jwt_refresh_key_for_update,
+    )
 
     route do |r|
-      @jwt_refresh_route = true
       before_jwt_refresh_route
 
       r.post do
+        @jwt_refresh_route = true
         if !session_value
           response.status ||= jwt_refresh_without_access_token_status
           json_response[json_response_error_key] = jwt_refresh_without_access_token_message
-        elsif (refresh_token = param_or_nil(jwt_refresh_token_key_param)) && account_from_refresh_token(refresh_token)
+        else
+          @jwt_refresh_key_for_update = true
           transaction do
-            before_refresh_token
-            formatted_token = generate_refresh_token
-            remove_jwt_refresh_token_key(refresh_token)
-            set_jwt_refresh_token_hmac_session_key(formatted_token)
-            json_response[jwt_refresh_token_key] = formatted_token
-            json_response[jwt_access_token_key] = session_jwt
-            after_refresh_token
+            if (refresh_token = param_or_nil(jwt_refresh_token_key_param)) && account_from_refresh_token(refresh_token)
+              before_refresh_token
+              formatted_token = generate_refresh_token
+              remove_jwt_refresh_token_key(refresh_token)
+              set_jwt_refresh_token_hmac_session_key(formatted_token)
+              json_response[jwt_refresh_token_key] = formatted_token
+              json_response[jwt_access_token_key] = session_jwt
+              after_refresh_token
+            else
+              json_response[json_response_error_key] = jwt_refresh_invalid_token_message
+            end
           end
-        else
-          json_response[json_response_error_key] = jwt_refresh_invalid_token_message
         end
         _return_json_response
       end
@@ -88,7 +94,7 @@ module Rodauth
     end
 
     def account_from_refresh_token(token)
-      @account = _account_from_refresh_token(token)
+      set_account(_account_from_refresh_token(token), :jwt_refresh)
     end
 
     def clear_tokens(reason)
@@ -142,7 +148,7 @@ module Rodauth
     end
 
     def _jwt_decode_opts
-      if allow_refresh_with_expired_jwt_access_token? && (@jwt_refresh_route || request.path == jwt_refresh_path)
+      if allow_refresh_with_expired_jwt_access_token? && (@jwt_refresh_route || (request.path == jwt_refresh_path && request.request_method == "POST"))
         Hash[super].merge!(:verify_expiration=>false)
       else
         super
@@ -165,8 +171,12 @@ module Rodauth
         where(Sequel::CURRENT_TIMESTAMP > jwt_refresh_token_deadline_column).
         delete
 
-      jwt_refresh_token_account_token_ds(account_id, token_id).
-        get(jwt_refresh_token_key_column)
+      ds = jwt_refresh_token_account_token_ds(account_id, token_id)
+      if @jwt_refresh_key_for_update
+        ds = ds.for_update
+        @jwt_refresh_key_for_update = nil
+      end
+      ds.get(jwt_refresh_token_key_column)
     end
 
     def jwt_refresh_token_account_ds(account_id)
@@ -214,7 +224,12 @@ module Rodauth
         else
           id, token_id, key = _account_refresh_token_split(token)
 
-          if id && token_id && key && (actual = get_active_refresh_token(session_value, token_id)) && timing_safe_eql?(key, convert_token_key(actual))
+          if id &&
+              token_id &&
+              key &&
+              (actual = get_active_refresh_token(session_value, token_id)) &&
+              (timing_safe_eql?(key, convert_token_key(actual)) || 
+                 (hmac_secret_rotation? && timing_safe_eql?(key, compute_old_hmac(actual))))
             jwt_refresh_token_account_token_ds(id, token_id).delete
           end
         end

data/lib/rodauth/features/lockout.rb

@@ -116,16 +116,19 @@ module Rodauth
       end
 
       r.post do
-        key = session[unlock_account_session_key] || param(unlock_account_key_param)
-        unless account_from_unlock_key(key)
-          set_redirect_error_status invalid_key_error_status
-          set_error_reason :invalid_unlock_account_key
-          set_redirect_error_flash no_matching_unlock_account_key_error_flash
-          redirect unlock_account_request_redirect
-        end
+        key = session_param(unlock_account_session_key, unlock_account_key_param)
+        select_key_for_update!
+
+        transaction do
+          unless key && account_from_unlock_key(key)
+            remove_session_value(unlock_account_session_key)
+            set_redirect_error_status invalid_key_error_status
+            set_error_reason :invalid_unlock_account_key
+            set_redirect_error_flash no_matching_unlock_account_key_error_flash
+            redirect unlock_account_request_redirect
+          end
 
-        if !unlock_account_requires_password? || password_match?(param(password_param))
-          transaction do
+          if !unlock_account_requires_password? || password_match?(param(password_param))
             before_unlock_account
             unlock_account
             clear_tokens(:unlock_account)
@@ -133,15 +136,15 @@ module Rodauth
             if unlock_account_autologin?
               autologin_session('unlock_account')
             end
-          end
 
-          remove_session_value(unlock_account_session_key)
-          unlock_account_response
-        else
-          set_response_error_reason_status(:invalid_password, invalid_password_error_status)
-          set_field_error(password_param, invalid_password_message)
-          set_error_flash unlock_account_error_flash
-          unlock_account_view
+            remove_session_value(unlock_account_session_key)
+            unlock_account_response
+          else
+            set_response_error_reason_status(:invalid_password, invalid_password_error_status)
+            set_field_error(password_param, invalid_password_message)
+            set_error_flash unlock_account_error_flash
+            unlock_account_view
+          end
         end
       end
     end
@@ -184,11 +187,11 @@ module Rodauth
           with_sql(:update_sql, account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1).
           single_value
       else
-        # :nocov:
+        # simplecov:disable
         if ds.update(account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1) > 0
           ds.get(account_login_failures_number_column)
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       unless number
@@ -221,7 +224,7 @@ module Rodauth
     end
 
     def account_from_unlock_key(key)
-      @account = _account_from_unlock_key(key)
+      set_account(_account_from_unlock_key(key), :unlock)
     end
 
     def unlock_account_email_link
@@ -310,7 +313,7 @@ module Rodauth
     end
 
     def _account_from_unlock_key(token)
-      account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
+      account_from_key(token){|id| apply_key_for_update(account_lockouts_ds(id)).get(account_lockouts_key_column)}
     end
   end
 end

data/lib/rodauth/features/login.rb

@@ -15,7 +15,7 @@ module Rodauth
     auth_value_method :login_error_status, 401
     translatable_method :login_form_footer_links_heading, '<h2 class="rodauth-login-form-footer-links-heading">Other Options</h2>'
     auth_value_method :login_return_to_requested_location?, false
-    auth_value_method :login_return_to_requested_location_max_path_size, 2048
+    def_deprecated_alias :return_to_path_max_size, :login_return_to_requested_location_max_path_size
     auth_value_method :use_multi_phase_login?, false
 
     session_key :login_redirect_session_key, :login_redirect
@@ -106,14 +106,14 @@ module Rodauth
     end
 
     def login_required
-      if login_return_to_requested_location? && (path = login_return_to_requested_location_path) && path.bytesize <= login_return_to_requested_location_max_path_size
-        set_session_value(login_redirect_session_key, path)
+      if login_return_to_requested_location?
+        set_session_return_to_path(login_redirect_session_key, login_return_to_requested_location_path)
       end
       super
     end
 
     def login_return_to_requested_location_path
-      request.fullpath if request.get?
+      request.fullpath
     end
 
     def after_login_entered_during_multi_phase_login
@@ -153,6 +153,14 @@ module Rodauth
       login_path
     end
 
+    def post_configure
+      # RODAUTH3: Remove
+      super
+      if method(:already_logged_in).owner == Rodauth::Base
+        missing_recommended_configuration("The Rodauth 'already_logged_in' configuration method was not used. Use the configuration method to define the behavior when accessing a page while logged in that is expected to be accessed when not logged in (safest to halt or redirect).")
+      end
+    end
+
     private
 
     def _login_response

data/lib/rodauth/features/login_password_requirements_base.rb

@@ -12,7 +12,7 @@ module Rodauth
     translatable_method :logins_do_not_match_message, 'logins do not match'
     auth_value_method :password_confirm_param, 'password-confirm'
     auth_value_method :password_minimum_length, 6
-    auth_value_method :password_maximum_bytes, nil
+    auth_value_method :password_maximum_bytes, nil # RODAUTH3: 72 if bcrypt is used
     auth_value_method :password_maximum_length, nil
     translatable_method :passwords_do_not_match_message, 'passwords do not match'
     auth_value_method :require_email_address_logins?, true
@@ -67,13 +67,39 @@ module Rodauth
     def set_password(password)
       hash = password_hash(password)
       if account_password_hash_column
-        update_account(account_password_hash_column=>hash)
-      elsif password_hash_ds.update(password_hash_column=>hash) == 0
-        # This shouldn't raise a uniqueness error, as the update should only fail for a new user,
-        # and an existing user should always have a valid password hash row.  If this does
-        # fail, retrying it will cause problems, it will override a concurrently running update
-        # with potentially a different password.
-        db[password_hash_table].insert(password_hash_id_column=>account_id, password_hash_column=>hash)
+        ds = account_ds
+
+        if @existing_password_hash_or_salt
+          ds = ds.where(account_password_hash_column => @existing_password_hash_or_salt)
+        end
+
+        unless update_account({account_password_hash_column=>hash}, ds) == 1
+          raise SetPasswordFailure, "set_password did not update password, either due to missing account, or concurrent password change"
+        end
+      else
+        ph_ds = ds = password_hash_ds
+        if @existing_password_hash_or_salt
+          existing_expression = if use_database_authentication_functions?
+            Sequel.function(function_name(:rodauth_get_salt), :id)
+          # simplecov:disable
+          else
+            password_hash_column
+          # simplecov:enable
+          end
+          ds = ds.where(existing_expression => @existing_password_hash_or_salt)
+        end
+
+        if ds.update(password_hash_column=>hash) == 0
+          if ph_ds.empty?
+            # This shouldn't raise a uniqueness error, as the update should only fail for a new user,
+            # and an existing user should always have a valid password hash row.  If this does
+            # fail, retrying it will cause problems, it will override a concurrently running update
+            # with potentially a different password.
+            db[password_hash_table].insert(password_hash_id_column=>account_id, password_hash_column=>hash)
+          else
+            raise SetPasswordFailure, "set_password did not update password due to concurrent password change"
+          end
+        end
       end
       hash
     end
@@ -133,12 +159,12 @@ module Rodauth
       def login_confirmation_matches?(login, login_confirmation)
         login.casecmp?(login_confirmation)
       end
-    # :nocov:
+    # simplecov:disable
     else
       def login_confirmation_matches?(login, login_confirmation)
         login.casecmp(login_confirmation) == 0
       end
-    # :nocov:
+    # simplecov:enable
     end
 
     def login_meets_length_requirements?(login)
@@ -174,7 +200,7 @@ module Rodauth
       elsif password_maximum_length && password_maximum_length < password.length
         set_password_requirement_error_message(:password_too_long, password_too_long_message)
         false
-      elsif password_maximum_bytes && password_maximum_bytes < password.bytesize
+      elsif password_maximum_bytes && password_maximum_bytes < password_bytesize(password)
         set_password_requirement_error_message(:password_too_many_bytes, password_too_many_bytes_message)
         false
       else
@@ -182,6 +208,10 @@ module Rodauth
       end
     end
 
+    def password_bytesize(password)
+      password.bytesize
+    end
+
     def password_does_not_contain_null_byte?(password)
       return true unless password.include?("\0")
       set_password_requirement_error_message(:password_contains_null_byte, contains_null_byte_message)
@@ -193,11 +223,11 @@ module Rodauth
         BCrypt::Engine::MIN_COST
       end
     else
-      # :nocov:
+      # simplecov:disable
       def password_hash_cost
         BCrypt::Engine::DEFAULT_COST
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     def extract_password_hash_cost(hash)

data/lib/rodauth/features/otp.rb

@@ -5,7 +5,7 @@ require 'rqrcode'
 
 module Rodauth
   Feature.define(:otp, :Otp) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain, :require_hmac_secret
 
     additional_form_tags 'otp_disable'
     additional_form_tags 'otp_auth'
@@ -127,13 +127,18 @@ module Rodauth
       end
 
       r.post do
-        if otp_valid_code?(param(otp_auth_param)) && otp_update_last_use
-          before_otp_authentication
-          two_factor_authenticate('totp')
+        transaction do
+          otp_key_ds.for_update.first
+
+          if otp_valid_code?(param(otp_auth_param)) && otp_update_last_use
+            before_otp_authentication
+            two_factor_authenticate('totp')
+          end
+
+          otp_record_authentication_failure
+          after_otp_authentication_failure
         end
 
-        otp_record_authentication_failure
-        after_otp_authentication_failure
         set_response_error_reason_status(:invalid_otp_auth_code, invalid_key_error_status)
         set_field_error(otp_auth_param, otp_invalid_auth_code_message)
         set_error_flash otp_auth_error_flash
@@ -265,15 +270,19 @@ module Rodauth
       return false unless otp_exists?
       ot_pass = ot_pass.gsub(/\s+/, '')
       if drift = otp_drift
+        # simplecov:disable
         if otp.respond_to?(:verify_with_drift)
-          # :nocov:
           otp.verify_with_drift(ot_pass, drift)
-          # :nocov:
+        # simplecov:enable
         else
-          otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift)
+          otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift, :after=>otp_last_use)
         end
-      else
+      # simplecov:disable
+      elsif otp.respond_to?(:verify_with_drift)
         otp.verify(ot_pass)
+      # simplecov:enable
+      else
+        otp.verify(ot_pass, :after=>otp_last_use)
       end
     end
 
@@ -404,11 +413,11 @@ module Rodauth
         ROTP::Base32.random_base32.downcase
       end
     else
-      # :nocov:
+      # simplecov:disable
       def otp_new_secret
         ROTP::Base32.random.downcase
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     def base32_encode(data, length)

data/lib/rodauth/features/otp_unlock.rb

@@ -181,9 +181,9 @@ module Rodauth
       end
 
       @otp_unlock_data = nil
-      # :nocov:
+      # simplecov:disable
       if otp_unlock_data
-      # :nocov:
+      # simplecov:enable
         if otp_unlock_num_successes >= otp_unlock_auths_required
           # At least the requisite number of consecutive successful unlock
           # authentications. Unlock OTP authentication.

data/lib/rodauth/features/password_complexity.rb

@@ -33,9 +33,9 @@ module Rodauth
         # nothing
       when nil
         default_dictionary_file = '/usr/share/dict/words'
-        # :nocov:
+        # simplecov:disable
         if File.file?(default_dictionary_file)
-        # :nocov:
+        # simplecov:enable
           words = File.read(default_dictionary_file)
         end
       else

data/lib/rodauth/features/password_expiration.rb

@@ -70,7 +70,6 @@ module Rodauth
         return password_changed_at + require_password_change_after < Time.now.to_i
       end
 
-      account_from_session
       if password_changed_at = get_password_changed_at
         set_session_value(password_changed_at_session_key, password_changed_at.to_i)
         password_changed_at + require_password_change_after < Time.now

data/lib/rodauth/features/password_grace_period.rb

@@ -33,6 +33,14 @@ module Rodauth
 
     private
 
+    def new_password_matches_current_password?(_)
+      last_password_entry = session[last_password_entry_session_key]
+      if v = super
+        set_session_value(last_password_entry_session_key, last_password_entry)
+      end
+      v
+    end
+
     def after_create_account
       super if defined?(super)
       @last_password_entry = Time.now.to_i

data/lib/rodauth/features/password_pepper.rb

@@ -12,7 +12,11 @@ module Rodauth
 
     def password_match?(password)
       if (result = super) && @previous_pepper_matched && password_pepper_update?
-        set_password(password)
+        begin
+          set_password(password)
+        rescue Rodauth::SetPasswordFailure
+          return false
+        end
       end
 
       result
@@ -24,6 +28,12 @@ module Rodauth
 
     private
 
+    def password_bytesize(password)
+      n = super 
+      n += password_pepper.bytesize if password_pepper
+      n
+    end
+
     def password_hash_match?(hash, password)
       return super if password_pepper.nil?
 

data/lib/rodauth/features/recovery_codes.rb

@@ -162,7 +162,10 @@ module Rodauth
     def recovery_code_match?(code)
       recovery_codes.each do |s|
         if timing_safe_eql?(code, s)
-          recovery_codes_ds.where(recovery_codes_column=>code).delete
+          unless recovery_codes_ds.where(recovery_codes_column=>code).delete == 1
+            return false
+          end
+
           if recovery_codes_primary?
             add_recovery_code
           end

data/lib/rodauth/features/remember.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:remember, :Remember) do
+    depends :require_hmac_secret
+
     notice_flash "Your remember setting has been updated"
     error_flash "There was an error updating your remember setting"
     loaded_templates %w'remember'
@@ -68,9 +70,9 @@ module Rodauth
         if [remember_remember_param_value, remember_forget_param_value, remember_disable_param_value].include?(remember)
           transaction do
             before_remember
-            # :nocov:
+            # simplecov:disable
             case remember
-            # :nocov:
+            # simplecov:enable
             when remember_remember_param_value
               remember_login
             when remember_forget_param_value

data/lib/rodauth/features/require_domain.rb

@@ -0,0 +1,12 @@
+# frozen-string-literal: true
+
+module Rodauth
+  Feature.define(:require_domain, :RequireDomain) do
+    def post_configure
+      super
+      if method(:domain).owner == Rodauth::Base
+        missing_recommended_configuration("The Rodauth 'domain' configuration method was not used. This can potentially leave the application vulnerable to requests that use malicious or invalid domains.")
+      end
+    end
+  end
+end

data/lib/rodauth/features/require_hmac_secret.rb

@@ -0,0 +1,12 @@
+# frozen-string-literal: true
+
+module Rodauth
+  Feature.define(:require_hmac_secret, :RequireHmacSecret) do
+    def post_configure
+      super
+      if method(:hmac_secret).owner == Rodauth::Base
+        missing_recommended_configuration("The Rodauth 'hmac_secret' configuration method was not used. This significantly reduces Rodauth's security. Consult the Rodauth README for what this method does, and set an appropriate value.")
+      end
+    end
+  end
+end

data/lib/rodauth/features/reset_password.rb

@@ -120,29 +120,26 @@ module Rodauth
       end
 
       r.post do
-        key = session[reset_password_session_key] || param(reset_password_key_param)
-        unless account_from_reset_password_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_reset_password_key
-          set_redirect_error_flash reset_password_error_flash
-          redirect reset_password_email_sent_redirect
-        end
-
+        key = session_param(reset_password_session_key, reset_password_key_param)
+        select_key_for_update!
         password = param(password_param)
+
         catch_error do
-          unless password_meets_requirements?(password)
-            throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
-          end
+          transaction do
+            handle_invalid_reset_password_key unless key && account_from_reset_password_key(key)
 
-          if password_match?(password) 
-            throw_error_reason(:same_as_existing_password, invalid_field_error_status, password_param, same_as_existing_password_message)
-          end
+            unless password_meets_requirements?(password)
+              throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+            end
 
-          if require_password_confirmation? && password != param(password_confirm_param)
-            throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
-          end
+            if password_match?(password) 
+              throw_error_reason(:same_as_existing_password, invalid_field_error_status, password_param, same_as_existing_password_message)
+            end
+
+            if require_password_confirmation? && password != param(password_confirm_param)
+              throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
+            end
 
-          transaction do
             before_reset_password
             set_password(password)
             clear_tokens(:reset_password)
@@ -184,7 +181,7 @@ module Rodauth
     end
 
     def account_from_reset_password_key(key)
-      @account = _account_from_reset_password_key(key)
+      set_account(_account_from_reset_password_key(key), :reset_password)
     end
 
     def reset_password_email_link
@@ -199,7 +196,7 @@ module Rodauth
     def get_reset_password_key(id)
       ds = password_reset_ds(id)
       ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete
-      ds.get(reset_password_key_column)
+      apply_key_for_update(ds).get(reset_password_key_column)
     end
 
     def set_reset_password_email_last_sent
@@ -267,5 +264,13 @@ module Rodauth
     def reset_password_account_status_value
       account_open_status_value
     end
+
+    def handle_invalid_reset_password_key
+      remove_session_value(reset_password_session_key)
+      set_redirect_error_status(invalid_key_error_status)
+      set_error_reason :invalid_reset_password_key
+      set_redirect_error_flash reset_password_error_flash
+      redirect reset_password_email_sent_redirect
+    end
   end
 end

data/lib/rodauth/features/single_session.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:single_session, :SingleSession) do
+    depends :require_hmac_secret
+
     error_flash 'This session has been logged out as another session has become active'
     redirect
 
@@ -29,13 +31,15 @@ module Rodauth
       single_session_key = session[single_session_session_key]
       current_key = single_session_ds.get(single_session_key_column)
       if single_session_key.nil?
-        unless current_key
+        if current_key
+          false
+        else
           # No row exists for this user, indicating the feature has never
           # been used, so it is OK to treat the current session as a new
           # session.
           update_single_session_key
+          true
         end
-        true
       elsif current_key
         if hmac_secret && !(valid = timing_safe_eql?(single_session_key, hmac = compute_hmac(current_key)))
           if hmac_secret_rotation? && (valid = timing_safe_eql?(single_session_key, compute_old_hmac(current_key)))