nodebb-plugin-session-sharing 8.0.6 → 9.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-session-sharing",
-  "version": "8.0.6",
+  "version": "9.0.0",
   "description": "Allows login sessions from your app to persist in NodeBB",
   "main": "library.js",
   "repository": {
@@ -41,7 +41,7 @@
   "dependencies": {
     "@commitlint/cli": "^9.1.2",
     "async": "^3",
-    "jsonwebtoken": "^8.5.1",
+    "jose": "^6.0.0",
     "lint-staged": "^10.0.9",
     "lodash": "^4.17.14"
   },

package/static/lib/admin.js

@@ -4,7 +4,10 @@ define('admin/plugins/session-sharing', ['settings'], function (Settings) {
 	const ACP = {};
 
 	ACP.init = function () {
-		Settings.load('session-sharing', $('.session-sharing-settings'));
+		// Settings.load is async: only toggle field visibility once the saved
+		// signingMethod value has been populated into the form.
+		Settings.load('session-sharing', $('.session-sharing-settings'), ACP.toggleSigningFields);
+		$('#signingMethod').on('change', ACP.toggleSigningFields);
 
 		$('#save').on('click', function () {
 			Settings.save('session-sharing', $('.session-sharing-settings'));
@@ -14,6 +17,19 @@ define('admin/plugins/session-sharing', ['settings'], function (Settings) {
 		$('#remote_search').on('keyup', ACP.findUserByRemoteId);
 	};
 
+	ACP.toggleSigningFields = function () {
+		const method = $('#signingMethod').val() || 'hmac';
+		if (method === 'rsa') {
+			$('#hmac-fields').hide();
+			$('#rsa-fields').show();
+			$('#rsa-sign-fields').show();
+		} else {
+			$('#hmac-fields').show();
+			$('#rsa-fields').hide();
+			$('#rsa-sign-fields').hide();
+		}
+	};
+
 	ACP.showUserId = function () {
 		if (ACP._searchDelay) {
 			clearTimeout(ACP._searchDelay);

package/static/templates/admin/plugins/session-sharing.tpl

@@ -25,6 +25,44 @@
 						</p>
 					</div>
 					<div class="mb-3">
+						<label class="form-label" for="hostWhitelist">Host Whitelist</label>
+						<input type="text" id="hostWhitelist" name="hostWhitelist" title="Host Whitelist" class="form-control" placeholder="localhost" />
+						<p class="form-text">
+							If set, session-sharing plugin works only on whitelisted domains. Separate with commas, for example: "localhost,test.domain.com".
+						</p>
+					</div>
+
+					<h5 class="fw-bold tracking-tight settings-header">Token Settings</h5>
+
+					<div class="mb-3">
+						<label class="form-label" for="signingMethod">Signing Method</label>
+						<select class="form-control" id="signingMethod" name="signingMethod">
+							<option value="hmac">HMAC (symmetric shared secret)</option>
+							<option value="rsa">RSA (asymmetric key pair)</option>
+						</select>
+						<p class="form-text">
+							HMAC uses a shared secret known to both parties. RSA uses an asymmetric key pair where only the
+							issuing server can sign, but any holder of the public key can verify.
+						</p>
+					</div>
+					<div class="mb-3">
+						<label class="form-label" for="tokenFormat">Token Format</label>
+						<select class="form-control" id="tokenFormat" name="tokenFormat">
+							<option value="jws">JWS (signed JWT)</option>
+							<option value="jwe">JWE (encrypted JWT)</option>
+						</select>
+						<p class="form-text">
+							JWS tokens are digitally signed: their payload is base64url-encoded and readable by anyone, but
+							tamper-proof. JWE tokens are encrypted: the payload is confidential and only decryptable with the
+							corresponding key. This setting controls the format of tokens <em>generated</em> by NodeBB (the
+							<code>nbb_token</code> reverse cookie and the development debug token).
+						</p>
+						<p class="form-text">
+							Incoming cookies are auto-detected, so <strong>both</strong> JWS and JWE tokens are accepted
+							regardless of this setting.
+						</p>
+					</div>
+					<div class="mb-3" id="hmac-fields">
 						<label class="form-label" for="secret">JWT Secret</label>
 						<input type="text" id="secret" name="secret" title="JWT Secret" class="form-control" />
 						<p class="form-text">
@@ -32,13 +70,20 @@
 							otherwise the JWT cannot be properly decoded.
 						</p>
 					</div>
-					<div class="mb-3">
-						<label class="form-label" for="hostWhitelist">Host Whitelist</label>
-						<input type="text" id="hostWhitelist" name="hostWhitelist" title="Host Whitelist" class="form-control" placeholder="localhost" />
+					<div class="mb-3" id="rsa-fields" style="display: none;">
+						<label class="form-label" for="publicKey">RSA Public Key</label>
+						<textarea id="publicKey" name="publicKey" title="RSA Public Key" class="form-control" rows="5" placeholder="-----BEGIN PUBLIC KEY-----&#10;...&#10;-----END PUBLIC KEY-----"></textarea>
 						<p class="form-text">
-							If set, session-sharing plugin works only on whitelisted domains. Separate with commas, for example: "localhost,test.domain.com".
+							The public key used to verify JWT signatures. This key is shared with clients so they can verify tokens.
 						</p>
 					</div>
+					<div class="mb-3" id="rsa-sign-fields" style="display: none;">
+						<label class="form-label" for="privateKey">RSA Private Key</label>
+						<textarea id="privateKey" name="privateKey" title="RSA Private Key" class="form-control" rows="5" placeholder="-----BEGIN PRIVATE KEY-----&#10;...&#10;-----END PRIVATE KEY-----"></textarea>
+						<p class="form-text">
+							The private key used to sign reverse tokens (if enabled), and to decrypt JWE (encrypted) cookies. Keep this secret — only the issuing server should have access to it.
+					</p>
+					</div>
 				</div>
 
 				<div class="mb-4">

package/test/index.js

@@ -6,6 +6,7 @@
 // Don't forget to add this plugin to `test_plugins` array in `config.json`
 
 const assert = require('assert');
+const crypto = require('crypto');
 const url = require('url');
 const util = require('util');
 const request = require('request-promise-native');
@@ -15,6 +16,17 @@ const db = nodebb.require('./test/mocks/databasemock');
 const nconf = nodebb.require('nconf');
 const meta = nodebb.require('./src/meta');
 
+/*
+ * meta.settings.setOne fires the `action:settings.set` hook without awaiting it,
+ * so the plugin's reloadSettings may still be running when setOne resolves.
+ * Awaiting reloadSettings directly keeps these tests deterministic.
+ * (Required lazily to avoid a circular dependency while mocha loads the suite.)
+ */
+const setSetting = async (key, value) => {
+	await meta.settings.setOne('session-sharing', key, value);
+	await require('../library').reloadSettings();
+};
+
 describe('nodebb-plugin-session-sharing', () => {
 	const userJar = request.jar();
 	const anonJar = request.jar();
@@ -30,7 +42,7 @@ describe('nodebb-plugin-session-sharing', () => {
 
 			assert.strictEqual(response.statusCode, 404);
 
-			await meta.settings.setOne('session-sharing', 'secret', 's3cr37c47');
+			await setSetting('secret', 's3cr37c47');
 		});
 
 		it('should generate a valid session when called', async () => {
@@ -76,12 +88,21 @@ describe('nodebb-plugin-session-sharing', () => {
 			});
 			assert.strictEqual(response.statusCode, 200);
 
+			// Core now initialises the guest session (CSRF token), so assert on the
+			// session contents: the guest must not have been logged in.
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
 			const cookies = anonJar.getCookies(`${protocol}//${hostname}/`);
-			assert(cookies.every(cookie => cookie.key !== 'express.sid'));
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			if (sidCookie) {
+				let sid = sidCookie.value.match(/s%3A([^.]+)/);
+				assert(sid && sid[1]);
+				const sessionObj = await getSession(sid[1]);
+				assert(!sessionObj || !sessionObj.passport || !sessionObj.passport.user);
+			}
 		});
 
 		it('should redirect a guest to a specified redirection target if configured', async () => {
-			await meta.settings.setOne('session-sharing', 'guestRedirect', 'https://example.org');
+			await setSetting('guestRedirect', 'https://example.org');
 			const response = await request(`${nconf.get('url')}`, {
 				resolveWithFullResponse: true,
 				jar: anonJar,
@@ -91,12 +112,12 @@ describe('nodebb-plugin-session-sharing', () => {
 
 			assert(response.statusCode, 302);
 			assert.strictEqual(response.headers.location, 'https://example.org');
-			await meta.settings.setOne('session-sharing', 'guestRedirect', '');
+			await setSetting('guestRedirect', '');
 		});
 
 		it('should maintain the login if behaviour is "revalidate"', async () => {
 			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
-			await meta.settings.setOne('session-sharing', 'behaviour', 'revalidate');
+			await setSetting('behaviour', 'revalidate');
 
 			await request(`${nconf.get('url')}`, {
 				resolveWithFullResponse: true,
@@ -152,7 +173,7 @@ describe('nodebb-plugin-session-sharing', () => {
 
 	describe('login override', () => {
 		it('should redirect a guest to a specified login override if configured', async () => {
-			await meta.settings.setOne('session-sharing', 'loginOverride', 'https://example.org/login');
+			await setSetting('loginOverride', 'https://example.org/login');
 			const response = await request(`${nconf.get('url')}/login`, {
 				resolveWithFullResponse: true,
 				jar: anonJar,
@@ -167,7 +188,7 @@ describe('nodebb-plugin-session-sharing', () => {
 
 	describe('register override', () => {
 		it('should redirect a guest to a specified register override if configured', async () => {
-			await meta.settings.setOne('session-sharing', 'registerOverride', 'https://example.org/register');
+			await setSetting('registerOverride', 'https://example.org/register');
 			const response = await request(`${nconf.get('url')}/register`, {
 				resolveWithFullResponse: true,
 				jar: anonJar,
@@ -179,4 +200,93 @@ describe('nodebb-plugin-session-sharing', () => {
 			assert.strictEqual(response.headers.location, 'https://example.org/register');
 		});
 	});
+
+	describe('JWE token support', () => {
+		const getTokenCookie = (jar) => {
+			const cookies = jar.getCookies(`${protocol}//${hostname}/`);
+			return cookies.find(cookie => cookie.key === 'token');
+		};
+
+		const assertLoggedIn = async (jar) => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = jar.getCookies(`${protocol}//${hostname}/`);
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+			const sid = sidCookie.value.match(/s%3A([^.]+)/)[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		};
+
+		it('should generate and accept an HMAC JWE token', async () => {
+			const jweJar = request.jar();
+			await setSetting('tokenFormat', 'jwe');
+
+			await request(`${nconf.get('url')}/debug/session`, { jar: jweJar });
+			const cookie = getTokenCookie(jweJar);
+			assert(cookie);
+			assert.strictEqual(cookie.value.split('.').length, 5);
+
+			await assertLoggedIn(jweJar);
+		});
+
+		it('should accept a JWS token even when tokenFormat is jwe (auto-detection)', async () => {
+			const jwsJar = request.jar();
+			await setSetting('tokenFormat', 'jws');
+
+			await request(`${nconf.get('url')}/debug/session`, { jar: jwsJar });
+			const cookie = getTokenCookie(jwsJar);
+			assert(cookie);
+			assert.strictEqual(cookie.value.split('.').length, 3);
+
+			await setSetting('tokenFormat', 'jwe');
+			await assertLoggedIn(jwsJar);
+		});
+
+		it('should generate and accept an RSA JWE token', async () => {
+			const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
+			await setSetting('publicKey', publicKey.export({ type: 'spki', format: 'pem' }));
+			await setSetting('privateKey', privateKey.export({ type: 'pkcs8', format: 'pem' }));
+			await setSetting('signingMethod', 'rsa');
+			await setSetting('tokenFormat', 'jwe');
+
+			const rsaJar = request.jar();
+			await request(`${nconf.get('url')}/debug/session`, { jar: rsaJar });
+			const cookie = getTokenCookie(rsaJar);
+			assert(cookie);
+			assert.strictEqual(cookie.value.split('.').length, 5);
+
+			await assertLoggedIn(rsaJar);
+		});
+
+		it('should reject a JWE token decrypted with the wrong key', async () => {
+			const { EncryptJWT } = require('jose');
+			const wrongKey = new Uint8Array(crypto.hkdfSync('sha256', 'wrong-secret', 'nodebb-plugin-session-sharing', 'A256GCM', 32));
+			const token = await new EncryptJWT({ id: 99999, username: 'intruder' })
+				.setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
+				.encrypt(wrongKey);
+
+			const badJar = request.jar();
+			badJar.setCookie(`token=${token}`, `${protocol}//${hostname}/`);
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: badJar,
+				simple: false,
+			});
+
+			assert.strictEqual(response.statusCode, 500);
+		});
+
+		it('should restore default signing settings', async () => {
+			await setSetting('signingMethod', 'hmac');
+			await setSetting('tokenFormat', 'jws');
+		});
+	});
 });