@crombolo/auth 0.17.0 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/auth",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "OAuth2 authorization server, password hashing, cookies and member tickets for crombolo.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,8 +28,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.17.0",
-    "@crombolo/data": "0.17.0",
+    "@crombolo/core": "0.19.0",
+    "@crombolo/data": "0.19.0",
     "jose": "^6.2.12",
     "uqr": "^0.1.3"
   }

package/src/index.ts

@@ -3,6 +3,7 @@ export * from './cookies.ts'
 export * from './device.ts'
 export * from './member-session.ts'
 export * from './oidc.ts'
+export * from './origin.ts'
 export * from './password.ts'
 export * from './pkce.ts'
 export * from './routes.ts'

package/src/origin.ts

@@ -0,0 +1,32 @@
+/**
+ * Cross-origin protection for cookie-authenticated writes. A browser marks every
+ * request with where it came from; a request carrying neither mark is not from a
+ * browser, so it cannot be a forged one and passes.
+ */
+
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
+
+/** Whether a method changes nothing, so needs no origin check. */
+export const isSafeMethod = (method: string): boolean => SAFE_METHODS.has(method.toUpperCase())
+
+/**
+ * Whether `request` came from this site rather than another origin — a sibling
+ * subdomain included. The `Origin` fallback compares hosts, since behind a proxy
+ * that ends TLS the request's own URL says `http` while the browser said `https`.
+ */
+export function isSameOrigin(request: Request, applicationUrl?: string): boolean {
+  const site = request.headers.get('sec-fetch-site')
+  if (site) return site === 'same-origin'
+  const origin = request.headers.get('origin')
+  if (origin === null) return true
+  let host: string
+  try {
+    host = new URL(origin).host
+  } catch {
+    return false
+  }
+  if (origin === new URL(request.url).origin) return true
+  if (applicationUrl && origin === new URL(applicationUrl).origin) return true
+  const forwarded = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim()
+  return host === (forwarded || request.headers.get('host'))
+}

package/src/routes.ts

@@ -16,6 +16,7 @@ import {
   serializeCookie,
 } from './cookies.ts'
 import { REMOTE_CLIENT_ID } from './device.ts'
+import { isSafeMethod, isSameOrigin } from './origin.ts'
 import type { AuthService } from './service.ts'
 import { BACKOFFICE_CLIENT_ID, DEFAULT_SCOPE } from './service.ts'
 import { readShortLived, signShortLived } from './short-lived.ts'
@@ -33,6 +34,10 @@ export interface AuthRouteOptions {
   backOfficePath: string
   service: AuthService
   cookies: CookieOptions
+  /** The site's public address, which a request's `Origin` may name behind a proxy. */
+  applicationUrl?: string
+  /** False refuses the password sign-in and its two-factor step, not merely hides the form. */
+  allowLocalLogin?: boolean
   /** Told about every sign-in, failed sign-in and sign-out, for the audit log. */
   onAudit?: (event: AuthAuditEvent, request: Request) => Promise<void>
   /** Two-factor sign-in (story 032): who has a provider on, and whether a code is theirs. */
@@ -501,14 +506,6 @@ export function createAuthRoutes(options: AuthRouteOptions): AuthRoutes {
     return sessionId ? (await service.resolveSession(sessionId))?.userId : undefined
   }
 
-  /** A cookie-authenticated write must come from this site, not a form elsewhere. */
-  const sameSite = (request: Request) => {
-    const site = request.headers.get('sec-fetch-site')
-    if (site) return site === 'same-origin'
-    const origin = request.headers.get('origin')
-    return !origin || origin === new URL(request.url).origin
-  }
-
   const signInFirst = () => problemResponse(problemDetails({ title: 'Sign in first', status: 401 }))
 
   /** What the approval page shows for a code, and its decision. */
@@ -537,7 +534,6 @@ export function createAuthRoutes(options: AuthRouteOptions): AuthRoutes {
       })
     }
     if (action === 'device/decide' && request.method === 'POST') {
-      if (!sameSite(request)) return new Response('Forbidden', { status: 403 })
       const body = (await request.json().catch(() => ({}))) as {
         userCode?: unknown
         approve?: unknown
@@ -564,7 +560,6 @@ export function createAuthRoutes(options: AuthRouteOptions): AuthRoutes {
     }
     const revoking = /^devices\/(\d+)$/.exec(action)
     if (revoking && request.method === 'DELETE') {
-      if (!sameSite(request)) return new Response('Forbidden', { status: 403 })
       return (await service.revokeDevice(Number(revoking[1]), userId))
         ? new Response(null, { status: 204 })
         : problemResponse(problemDetails({ title: 'No such device', status: 404 }))
@@ -577,9 +572,24 @@ export function createAuthRoutes(options: AuthRouteOptions): AuthRoutes {
       if (!pathname.startsWith(`${prefix}/`)) return undefined
       const action = pathname.slice(prefix.length + 1)
       const url = new URL(request.url)
+      // Every write here reads a cookie or sets one, so none may come from another origin.
+      if (!isSafeMethod(request.method) && !isSameOrigin(request, options.applicationUrl))
+        return new Response('Forbidden', { status: 403 })
 
       if (action === 'authorize' && request.method === 'GET') return handleAuthorize(request, url)
       if (action === 'token' && request.method === 'POST') return handleToken(request, url)
+      if (
+        options.allowLocalLogin === false &&
+        (action === 'login' || action === 'verify-2fa') &&
+        request.method === 'POST'
+      )
+        return problemResponse(
+          problemDetails({
+            title: 'Signing in with a password is turned off',
+            status: 403,
+            detail: 'This site signs people in through its identity provider.',
+          }),
+        )
       if (action === 'login' && request.method === 'POST') return handleLogin(request)
       if (action === 'revoke' && request.method === 'POST') return handleRevoke(request)
       if (action === 'signout') return handleSignOut(request, url)