mbkauthe 1.0.22 → 1.0.24

package/lib/main.js

@@ -1,4 +1,4 @@
-import express from "express";
+import express, { json } from "express";
 import crypto from "crypto";
 import session from "express-session";
 import pgSession from "connect-pg-simple";
@@ -8,6 +8,7 @@ import { authenticate } from "./validateSessionAndRole.js";
 import fetch from 'node-fetch';
 import cookieParser from "cookie-parser";
 import bcrypt from 'bcrypt';
+import rateLimit from 'express-rate-limit';
 
 import { createRequire } from "module";
 const require = createRequire(import.meta.url);
@@ -20,18 +21,6 @@ dotenv.config();
 const mbkautheVar = JSON.parse(process.env.mbkautheVar);
 
 const router = express.Router();
-let COOKIE_EXPIRE_TIME = 2 * 24 * 60 * 60 * 1000; // 2 days
-
-try {
-  const parsedExpireTime = parseInt(mbkautheVar.COOKIE_EXPIRE_TIME, 10);
-  if (!isNaN(parsedExpireTime) && parsedExpireTime > 0) {
-    COOKIE_EXPIRE_TIME = parsedExpireTime * 24 * 60 * 60 * 1000;
-  } else {
-    console.warn("Invalid COOKIE_EXPIRE_TIME, using default value");
-  }
-} catch (error) {
-  console.log("Error parsing COOKIE_EXPIRE_TIME:", error);
-}
 
 // Enable CORS for subdomains
 router.use((req, res, next) => {
@@ -49,6 +38,46 @@ router.use(express.json());
 router.use(express.urlencoded({ extended: true }));
 router.use(cookieParser());
 
+// Add rate limiting for sensitive operations
+const LoginLimit = rateLimit({
+  windowMs: 1 * 60 * 1000,
+  max: 8,
+  message: { success: false, message: "Too many attempts, please try again later" },
+  skip: (req) => {
+    return !!req.session.user;
+  }
+});
+
+router.use((req, res, next) => {
+  // Don't allow embedding in iframes
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  // Prevent MIME type sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // Enable XSS protection
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+
+  // Referrer policy
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Content Security Policy
+  const csp = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "connect-src 'self' https://www.google.com",
+    "frame-src https://www.google.com",
+    "form-action 'self'"
+  ].join('; ');
+
+  res.setHeader('Content-Security-Policy', csp);
+
+  next();
+});
+
+
 // Configure session with proper domain settings for cross-subdomain sharing
 const sessionConfig = {
   store: new PgSession({
@@ -61,7 +90,7 @@ const sessionConfig = {
   saveUninitialized: false,
   proxy: true, // Trust the reverse proxy
   cookie: {
-    maxAge: COOKIE_EXPIRE_TIME,
+    maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
     domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
     httpOnly: true,
     secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false, // 'auto' respects X-Forwarded-Proto
@@ -98,7 +127,7 @@ router.use(async (req, res, next) => {
 
 // Set consistent cookie options for all cookies
 const getCookieOptions = () => ({
-  maxAge: COOKIE_EXPIRE_TIME,
+  maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
   secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
   sameSite: 'lax',
@@ -144,7 +173,7 @@ router.post("/mbkauthe/api/terminateAllSessions", authenticate(mbkautheVar.Main_
   }
 });
 
-router.post("/mbkauthe/api/login", async (req, res) => {
+router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
   console.log("Login request received");
 
   const { username, password, token, recaptcha } = req.body;
@@ -325,13 +354,69 @@ router.post("/mbkauthe/api/logout", async (req, res) => {
 });
 
 // Return package.json data of mbkauthe
-router.get("/mbkauthe/package", (_, res) => {
-  res.status(200).json({ version: packageJson });
+router.get("/mbkauthe/package", async (_, res) => {
+  try {
+    const response = await fetch("https://mbkauthe.mbktechstudio.com/mbkauthe/package");
+    const latestPackageData = await response.json();
+    res.status(200).send(`
+      <html>
+        <head>
+          <title>Package Information</title>
+        </head>
+        <body>
+          <h1>Package Information</h1>
+          <p><strong>Current Version:</strong> ${JSON.stringify(packageJson, null, 2)}</p>
+          <p><strong>Latest Version:</strong> ${JSON.stringify(latestPackageData, null, 2)}</p>
+        </body>
+      </html>
+    `);
+  } catch (err) {
+    res.status(200).send(`
+      <html>
+        <head>
+          <title>Package Information</title>
+        </head>
+        <body>
+          <h1>Package Information</h1>
+          <p><strong>Current Version:</strong>  ${JSON.stringify(packageJson, null, 2)}</p>
+          <p><strong>Latest Version:</strong> Failed to fetch latest package data, Erro:${err.message}</p>
+        </body>
+      </html>
+    `);
+  }
 });
 
 // Return version number of mbkauthe
-router.get(["/mbkauthe/version", "/mbkauthe/v"], (_, res) => {
-  res.status(200).json({ version: packageJson.version });
+router.get(["/mbkauthe/version", "/mbkauthe/v"], async(_, res) => {
+  try {
+    const response = await fetch("https://mbkauthe.mbktechstudio.com/mbkauthe/version");
+    const latestPackageData = await response.json();
+    res.status(200).send(`
+      <html>
+        <head>
+          <title>Version Information</title>
+        </head>
+        <body>
+          <h1>Package Information</h1>
+          <p><strong>Current Version:</strong> ${JSON.stringify(packageJson.version, null, 2)}</p>
+          <p><strong>Latest Version:</strong> ${JSON.stringify(latestPackageData, null, 2)}</p>
+        </body>
+      </html>
+    `);
+  } catch (err) {
+    res.status(200).send(`
+      <html>
+        <head>
+          <title>Package Information</title>
+        </head>
+        <body>
+          <h1>Package Information</h1>
+          <p><strong>Current Version:</strong>  ${JSON.stringify(packageJson.version, null, 2)}</p>
+          <p><strong>Latest Version:</strong> Failed to fetch latest package data, Erro:${err.message}</p>
+        </body>
+      </html>
+    `);
+  }
 });
 
 // Return package-lock.json data of mbkauthe from project the package is installed in

package/lib/validateSessionAndRole.js

@@ -3,7 +3,7 @@ const mbkautheVar = JSON.parse(process.env.mbkautheVar);
 
 // Get consistent cookie options
 const getCookieOptions = () => ({
-  maxAge: COOKIE_EXPIRE_TIME,
+  maxAge: mbkautheVar.COOKIE_EXPIRE_TIME,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
   secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
   sameSite: 'lax',

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "mbkauthe",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",
   "scripts": {
-    "test": "set test=true&& node index.js"
+    "test": "set test=true&& nodemon index.js"
   },
   "repository": {
     "type": "git",
@@ -31,8 +31,12 @@
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
     "express": "^5.1.0",
+    "express-rate-limit": "^7.5.0",
     "express-session": "^1.18.1",
     "node-fetch": "^3.3.2",
     "pg": "^8.14.1"
+  },
+  "devDependencies": {
+    "nodemon": "^2.0.22"
   }
 }

package/vercel.json

@@ -0,0 +1,15 @@
+{
+    "version": 2,
+    "builds": [
+      {
+        "src": "index.js",
+        "use": "@vercel/node"
+      }
+    ],
+    "routes": [
+      {
+        "src": "/(.*)",
+        "dest": "/index.js"
+      }
+    ]
+  }

package/.github/workflows/apisec-scan.yml

@@ -1,71 +0,0 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# APIsec addresses the critical need to secure APIs before they reach production.
-# APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs.
-# Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities.
-
-# How to Get Started with APIsec.ai
-# 1. Schedule a demo at https://www.apisec.ai/request-a-demo .
-#
-# 2. Register your account at https://cloud.apisec.ai/#/signup .
-#
-# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly.
-#
-# 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions
-#
-# apisec-run-scan
-#
-# This action triggers the on-demand scans for projects registered in APIsec.
-# If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings.
-# Else you can view the scan results from the project home page in APIsec Platform.
-# The link to view the scan results is also displayed on the console on successful completion of action.
-
-# This is a starter workflow to help you get started with APIsec-Scan Actions
-
-name: APIsec
-
-# Controls when the workflow will run
-on:
-  # Triggers the workflow on push or pull request events but only for the "main" branch
-  # Customize trigger events based on your DevSecOps processes.
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '44 15 * * 0'
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-
-permissions:
-  contents: read
-
-jobs:
-
-  Trigger_APIsec_scan:
-    permissions:
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
-    runs-on: ubuntu-latest
-
-    steps:
-       - name: APIsec scan
-         uses: apisec-inc/apisec-run-scan@025432089674a28ba8fb55f8ab06c10215e772ea
-         with:
-          # The APIsec username with which the scans will be executed
-          apisec-username: ${{ secrets.apisec_username }}
-          # The Password of the APIsec user with which the scans will be executed
-          apisec-password: ${{ secrets.apisec_password}}
-          # The name of the project for security scan
-          apisec-project: "VAmPI"
-          # The name of the sarif format result file The file is written only if this property is provided.
-          sarif-result-file: "apisec-results.sarif"
-       - name: Import results
-         uses: github/codeql-action/upload-sarif@v3
-         with:
-          sarif_file: ./apisec-results.sarif