mbkauthe 1.0.21 → 1.0.23

package/index.js

@@ -1,3 +1,4 @@
+import express from "express"; // Add this line
 import router from "./lib/main.js";
 
 import dotenv from "dotenv";

package/lib/main.js

@@ -7,6 +7,8 @@ import { dblogin } from "./pool.js";
 import { authenticate } from "./validateSessionAndRole.js";
 import fetch from 'node-fetch';
 import cookieParser from "cookie-parser";
+import bcrypt from 'bcrypt';
+import rateLimit from 'express-rate-limit';
 
 import { createRequire } from "module";
 const require = createRequire(import.meta.url);
@@ -19,18 +21,6 @@ dotenv.config();
 const mbkautheVar = JSON.parse(process.env.mbkautheVar);
 
 const router = express.Router();
-let COOKIE_EXPIRE_TIME = 2 * 24 * 60 * 60 * 1000; // 2 days
-
-try {
-  const parsedExpireTime = parseInt(mbkautheVar.COOKIE_EXPIRE_TIME, 10);
-  if (!isNaN(parsedExpireTime) && parsedExpireTime > 0) {
-    COOKIE_EXPIRE_TIME = parsedExpireTime * 24 * 60 * 60 * 1000;
-  } else {
-    console.warn("Invalid COOKIE_EXPIRE_TIME, using default value");
-  }
-} catch (error) {
-  console.log("Error parsing COOKIE_EXPIRE_TIME:", error);
-}
 
 // Enable CORS for subdomains
 router.use((req, res, next) => {
@@ -48,6 +38,16 @@ router.use(express.json());
 router.use(express.urlencoded({ extended: true }));
 router.use(cookieParser());
 
+// Add rate limiting for sensitive operations
+const LoginLimit = rateLimit({
+  windowMs: 1 * 60 * 1000,
+  max: 15,
+  message: 'Too many attempts, please try again later',
+  skip: (req) => {
+    return !!req.session.user;
+  }
+});
+
 // Configure session with proper domain settings for cross-subdomain sharing
 const sessionConfig = {
   store: new PgSession({
@@ -60,7 +60,7 @@ const sessionConfig = {
   saveUninitialized: false,
   proxy: true, // Trust the reverse proxy
   cookie: {
-    maxAge: COOKIE_EXPIRE_TIME,
+    maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
     domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
     httpOnly: true,
     secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false, // 'auto' respects X-Forwarded-Proto
@@ -97,7 +97,7 @@ router.use(async (req, res, next) => {
 
 // Set consistent cookie options for all cookies
 const getCookieOptions = () => ({
-  maxAge: COOKIE_EXPIRE_TIME,
+  maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
   secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
   sameSite: 'lax',
@@ -143,7 +143,7 @@ router.post("/mbkauthe/api/terminateAllSessions", authenticate(mbkautheVar.Main_
   }
 });
 
-router.post("/mbkauthe/api/login", async (req, res) => {
+router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
   console.log("Login request received");
 
   const { username, password, token, recaptcha } = req.body;
@@ -195,9 +195,24 @@ router.post("/mbkauthe/api/login", async (req, res) => {
 
     const user = userResult.rows[0];
 
-    if (user.Password !== password) {
-      console.log(`Incorrect password for username: ${username}`);
-      return res.status(401).json({ success: false, message: "Incorrect Username Or Password" });
+    if (mbkautheVar.EncryptedPassword === "true") {
+      try {
+        const result = await bcrypt.compare(password, user.Password);
+        if (!result) {
+          console.log("Incorrect password.");
+          return res.status(401).json({ success: false, errorCode: 603, message: "Incorrect Username Or Password." });
+        }
+        console.log("Password matches!");
+      } catch (err) {
+        console.error("Error comparing password:", err);
+        return res.status(500).json({ success: false, errorCode: 605, message: `Internal Server Error` });
+      }
+    } else {
+      // Check if the password matches
+      if (user.Password !== password) {
+        console.log(`Incorrect password for username: ${username}`);
+        return res.status(401).json({ success: false, errorCode: 603, message: "Incorrect Username Or Password" });
+      }
     }
 
     if (!user.Active) {

package/lib/validateSessionAndRole.js

@@ -3,7 +3,7 @@ const mbkautheVar = JSON.parse(process.env.mbkautheVar);
 
 // Get consistent cookie options
 const getCookieOptions = () => ({
-  maxAge: COOKIE_EXPIRE_TIME,
+  maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
   secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
   sameSite: 'lax',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",
@@ -26,12 +26,14 @@
   },
   "homepage": "https://github.com/MIbnEKhalid/mbkauthe#readme",
   "dependencies": {
+    "bcrypt": "^5.1.1",
     "connect-pg-simple": "^10.0.0",
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
     "express": "^5.1.0",
+    "express-rate-limit": "^7.5.0",
     "express-session": "^1.18.1",
     "node-fetch": "^3.3.2",
     "pg": "^8.14.1"
   }
-}
+}