ep_openid_connect 2.1.1 → 2.1.2

package/index.js

@@ -19,6 +19,15 @@ let oidcClient = null;
 const ep = (endpoint) => `/ep_openid_connect/${endpoint}`;
 const endpointUrl = (endpoint) => new URL(ep(endpoint).substr(1), settings.base_url).toString();
 
+const validateSubClaim = (sub) => {
+  if (typeof sub !== 'string' || // 'sub' claim must exist as a string per OIDC spec.
+      sub === '' || // Empty string doesn't make sense.
+      sub === '__proto__' || // Prevent prototype pollution.
+      settings.prohibited_usernames.includes(sub)) {
+    throw new Error('invalid sub claim');
+  }
+};
+
 const discoverIssuer = async (issuerUrl) => {
   issuerUrl = new URL(issuerUrl);
   // https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery says that the URI
@@ -98,26 +107,34 @@ exports.clientVars = (hookName, context) => {
 exports.expressCreateServer = (hookName, {app}) => {
   if (oidcClient == null) return;
   logger.debug('Configuring auth routes');
-  app.get(ep('callback'), (req, res, next) => {
-    logger.debug(`Processing ${req.url}`);
-    (async () => {
+  app.get(ep('callback'), async (req, res, next) => {
+    // This handler MUST NOT redirect to a page that requires authentication if there is a problem,
+    // otherwise the user could be caught in an infinite redirect loop.
+    try {
+      logger.debug(`Processing ${req.url}`);
       const params = oidcClient.callbackParams(req);
       const oidcSession = req.session.ep_openid_connect || {};
-      const {authParams} = oidcSession;
-      if (authParams == null) throw new Error('no authentication paramters found in session state');
-      const tokenset = await oidcClient.callback(endpointUrl('callback'), params, authParams);
-      oidcSession.userinfo = await oidcClient.userinfo(tokenset);
+      if (oidcSession.authParams == null) throw new Error('missing authentication paramters');
+      const tokenset =
+          await oidcClient.callback(endpointUrl('callback'), params, oidcSession.authParams);
+      const userinfo = await oidcClient.userinfo(tokenset);
+      validateSubClaim(userinfo.sub);
       // The user has successfully authenticated, but don't set req.session.user here -- do it in
       // the authenticate hook so that Etherpad can log the authentication success. However, DO "log
       // out" the previous user to force the authenticate hook to run in case the user was already
       // authenticated as someone else.
       delete req.session.user;
+      // userinfo should not be stored in req.session until after all checks have passed. (Otherwise
+      // it would be too easy to accidentally introduce a vulnerability.)
+      oidcSession.userinfo = userinfo;
       res.redirect(oidcSession.next || settings.base_url);
       // Defer deletion of state until success so that the user can reload the page to retry after a
       // transient backchannel failure.
       delete oidcSession.authParams;
       delete oidcSession.next;
-    })().catch(next);
+    } catch (err) {
+      return next(err);
+    }
   });
   app.get(ep('login'), (req, res, next) => {
     logger.debug(`Processing ${req.url}`);
@@ -137,32 +154,26 @@ exports.expressCreateServer = (hookName, {app}) => {
 exports.authenticate = (hookName, {req, res, users}) => {
   if (oidcClient == null) return;
   logger.debug('authenticate hook for', req.url);
-  const {session} = req;
-  const {ep_openid_connect: {userinfo = {}} = {}} = session;
-  const {sub} = userinfo;
-  if (sub == null || // Nullish means the user isn't authenticated.
-      typeof sub !== 'string' || // `sub` is used as the username, so it must be a string.
-      sub === '' || // Empty string doesn't make sense.
-      sub === '__proto__' || // Prevent prototype pollution.
-      settings.prohibited_usernames.includes(sub)) {
+  const {ep_openid_connect: {userinfo} = {}} = req.session;
+  if (userinfo == null) { // Nullish means the user isn't authenticated.
     // Out of an abundance of caution, clear out the old state, nonce, and userinfo (if present) to
     // force regeneration.
-    delete session.ep_openid_connect;
+    delete req.session.ep_openid_connect;
     // Authn failed. Let another plugin try to authenticate the user.
     return;
   }
   // Successfully authenticated.
   logger.info('Successfully authenticated user with userinfo:', userinfo);
-  session.user = users[sub];
-  if (session.user == null) session.user = users[sub] = {};
+  req.session.user = users[userinfo.sub];
+  if (req.session.user == null) req.session.user = users[userinfo.sub] = {};
   for (const [propName, descriptor] of Object.entries(settings.user_properties)) {
     if (descriptor.claim != null && descriptor.claim in userinfo) {
-      session.user[propName] = userinfo[descriptor.claim];
-    } else if ('default' in descriptor && !(propName in session.user)) {
-      session.user[propName] = descriptor.default;
+      req.session.user[propName] = userinfo[descriptor.claim];
+    } else if ('default' in descriptor && !(propName in req.session.user)) {
+      req.session.user[propName] = descriptor.default;
     }
   }
-  logger.debug('User properties:', session.user);
+  logger.debug('User properties:', req.session.user);
   return true;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {