awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-16 17:30:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Upgraded JWT invalidation/session logic to separate TokenVersion model.

Browse Source
This commit is contained in:
Tuan Dang
2023-06-06 16:36:52 +01:00
parent b9dad5c3f0
commit 846f5c6680
14 changed files with 170 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/controllers/v1/authController.ts
+28 -9
View File
@@ -13,7 +13,8 @@ import { createToken, issueAuthTokens, clearTokens } from '../../helpers/auth';
import { checkUserDevice } from '../../helpers/user';
import {
ACTION_LOGIN,
ACTION_LOGOUT
ACTION_LOGOUT,
AUTH_MODE_JWT
} from '../../variables';
import {
BadRequestError,
@@ -127,7 +128,11 @@ export const login2 = async (req: Request, res: Response) => {
userAgent: req.headers['user-agent'] ?? ''
});
const tokens = await issueAuthTokens({ userId: user._id.toString() });
const tokens = await issueAuthTokens({
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
// store (refresh) token in httpOnly cookie
res.cookie('jid', tokens.refreshToken, {
@@ -181,7 +186,10 @@ export const login2 = async (req: Request, res: Response) => {
*/
export const logout = async (req: Request, res: Response) => {
try {
await clearTokens(req.user._id);
if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User && req.authData.tokenVersionId) {
await clearTokens(req.authData.tokenVersionId)
}
// clear httpOnly cookie
res.cookie('jid', '', {
@@ -216,6 +224,21 @@ export const logout = async (req: Request, res: Response) => {
});
};
export const revokeAllSessions = async (req: Request, res: Response) => {
await TokenVersion.updateMany({
user: req.user._id
}, {
$inc: {
refreshVersion: 1,
accessVersion: 1
}
});
return res.status(200).send({
message: 'Successfully revoked all sessions.'
});
}
/**
* Return user is authenticated
* @param req
@@ -254,12 +277,7 @@ export const getNewToken = async (req: Request, res: Response) => {
if (!user?.publicKey)
throw new Error('Failed to authenticate not fully set up account');
const tokenVersion = await TokenVersion.findOne({
_id: decodedToken.tokenVersionId,
user: user._id
});
console.log('tokenVersion: ', tokenVersion);
const tokenVersion = await TokenVersion.findById(decodedToken.tokenVersionId);
if (!tokenVersion) throw UnauthorizedRequestError({
message: 'Failed to validate refresh token'
@@ -272,6 +290,7 @@ export const getNewToken = async (req: Request, res: Response) => {
const token = createToken({
payload: {
userId: decodedToken.userId,
tokenVersionId: tokenVersion._id.toString(),
accessVersion: tokenVersion.refreshVersion
},
expiresIn: await getJwtAuthLifetime(),
backend/src/controllers/v2/authController.ts
+10 -6
View File
@@ -22,10 +22,6 @@ import {
getHttpsEnabled
} from '../../config';
// note: move this out
import path from 'path';
import fs from 'fs';
declare module 'jsonwebtoken' {
export interface UserIDJwtPayload extends jwt.JwtPayload {
userId: string;
@@ -160,7 +156,11 @@ export const login2 = async (req: Request, res: Response) => {
});
// issue tokens
const tokens = await issueAuthTokens({ userId: user._id.toString() });
const tokens = await issueAuthTokens({
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
// store (refresh) token in httpOnly cookie
res.cookie('jid', tokens.refreshToken, {
@@ -301,7 +301,11 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
});
// issue tokens
const tokens = await issueAuthTokens({ userId: user._id.toString() });
const tokens = await issueAuthTokens({
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
// store (refresh) token in httpOnly cookie
res.cookie('jid', tokens.refreshToken, {
backend/src/controllers/v2/signupController.ts
+6 -2
View File
@@ -116,7 +116,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
// issue tokens
const tokens = await issueAuthTokens({
userId: user._id.toString()
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
token = tokens.token;
@@ -247,7 +249,9 @@ export const completeAccountInvite = async (req: Request, res: Response) => {
// issue tokens
const tokens = await issueAuthTokens({
userId: user._id.toString()
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
token = tokens.token;
backend/src/controllers/v3/authController.ts
+5 -5
View File
@@ -183,12 +183,12 @@ export const login2 = async (req: Request, res: Response) => {
userAgent: req.headers['user-agent'] ?? ''
});
console.log('logged in, issue tokens');
console.log('ip: ', req.ip);
console.log('userAgent: ', req.headers['user-agent']);
// issue tokens
const tokens = await issueAuthTokens({ userId: user._id.toString() });
const tokens = await issueAuthTokens({
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
// store (refresh) token in httpOnly cookie
res.cookie('jid', tokens.refreshToken, {
backend/src/controllers/v3/signupController.ts
+3 -1
View File
@@ -137,7 +137,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
// issue tokens
const tokens = await issueAuthTokens({
userId: user._id.toString()
userId: user._id,
ip: req.ip,
userAgent: req.headers['user-agent'] ?? ''
});
token = tokens.token;