mbkauthe 1.0.22 → 1.0.23

package/lib/main.js

@@ -8,6 +8,7 @@ import { authenticate } from "./validateSessionAndRole.js";
 import fetch from 'node-fetch';
 import cookieParser from "cookie-parser";
 import bcrypt from 'bcrypt';
+import rateLimit from 'express-rate-limit';
 
 import { createRequire } from "module";
 const require = createRequire(import.meta.url);
@@ -20,18 +21,6 @@ dotenv.config();
 const mbkautheVar = JSON.parse(process.env.mbkautheVar);
 
 const router = express.Router();
-let COOKIE_EXPIRE_TIME = 2 * 24 * 60 * 60 * 1000; // 2 days
-
-try {
-  const parsedExpireTime = parseInt(mbkautheVar.COOKIE_EXPIRE_TIME, 10);
-  if (!isNaN(parsedExpireTime) && parsedExpireTime > 0) {
-    COOKIE_EXPIRE_TIME = parsedExpireTime * 24 * 60 * 60 * 1000;
-  } else {
-    console.warn("Invalid COOKIE_EXPIRE_TIME, using default value");
-  }
-} catch (error) {
-  console.log("Error parsing COOKIE_EXPIRE_TIME:", error);
-}
 
 // Enable CORS for subdomains
 router.use((req, res, next) => {
@@ -49,6 +38,16 @@ router.use(express.json());
 router.use(express.urlencoded({ extended: true }));
 router.use(cookieParser());
 
+// Add rate limiting for sensitive operations
+const LoginLimit = rateLimit({
+  windowMs: 1 * 60 * 1000,
+  max: 15,
+  message: 'Too many attempts, please try again later',
+  skip: (req) => {
+    return !!req.session.user;
+  }
+});
+
 // Configure session with proper domain settings for cross-subdomain sharing
 const sessionConfig = {
   store: new PgSession({
@@ -61,7 +60,7 @@ const sessionConfig = {
   saveUninitialized: false,
   proxy: true, // Trust the reverse proxy
   cookie: {
-    maxAge: COOKIE_EXPIRE_TIME,
+    maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
     domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
     httpOnly: true,
     secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false, // 'auto' respects X-Forwarded-Proto
@@ -98,7 +97,7 @@ router.use(async (req, res, next) => {
 
 // Set consistent cookie options for all cookies
 const getCookieOptions = () => ({
-  maxAge: COOKIE_EXPIRE_TIME,
+  maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
   secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
   sameSite: 'lax',
@@ -144,7 +143,7 @@ router.post("/mbkauthe/api/terminateAllSessions", authenticate(mbkautheVar.Main_
   }
 });
 
-router.post("/mbkauthe/api/login", async (req, res) => {
+router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
   console.log("Login request received");
 
   const { username, password, token, recaptcha } = req.body;

package/lib/validateSessionAndRole.js

@@ -3,7 +3,7 @@ const mbkautheVar = JSON.parse(process.env.mbkautheVar);
 
 // Get consistent cookie options
 const getCookieOptions = () => ({
-  maxAge: COOKIE_EXPIRE_TIME,
+  maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
   secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
   sameSite: 'lax',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",
@@ -31,6 +31,7 @@
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
     "express": "^5.1.0",
+    "express-rate-limit": "^7.5.0",
     "express-session": "^1.18.1",
     "node-fetch": "^3.3.2",
     "pg": "^8.14.1"

package/.github/workflows/apisec-scan.yml

@@ -1,71 +0,0 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# APIsec addresses the critical need to secure APIs before they reach production.
-# APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs.
-# Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities.
-
-# How to Get Started with APIsec.ai
-# 1. Schedule a demo at https://www.apisec.ai/request-a-demo .
-#
-# 2. Register your account at https://cloud.apisec.ai/#/signup .
-#
-# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly.
-#
-# 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions
-#
-# apisec-run-scan
-#
-# This action triggers the on-demand scans for projects registered in APIsec.
-# If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings.
-# Else you can view the scan results from the project home page in APIsec Platform.
-# The link to view the scan results is also displayed on the console on successful completion of action.
-
-# This is a starter workflow to help you get started with APIsec-Scan Actions
-
-name: APIsec
-
-# Controls when the workflow will run
-on:
-  # Triggers the workflow on push or pull request events but only for the "main" branch
-  # Customize trigger events based on your DevSecOps processes.
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '44 15 * * 0'
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-
-permissions:
-  contents: read
-
-jobs:
-
-  Trigger_APIsec_scan:
-    permissions:
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
-    runs-on: ubuntu-latest
-
-    steps:
-       - name: APIsec scan
-         uses: apisec-inc/apisec-run-scan@025432089674a28ba8fb55f8ab06c10215e772ea
-         with:
-          # The APIsec username with which the scans will be executed
-          apisec-username: ${{ secrets.apisec_username }}
-          # The Password of the APIsec user with which the scans will be executed
-          apisec-password: ${{ secrets.apisec_password}}
-          # The name of the project for security scan
-          apisec-project: "VAmPI"
-          # The name of the sarif format result file The file is written only if this property is provided.
-          sarif-result-file: "apisec-results.sarif"
-       - name: Import results
-         uses: github/codeql-action/upload-sarif@v3
-         with:
-          sarif_file: ./apisec-results.sarif