Do Siki
c5d5198fbf
CI Pipeline with Test Management / 🧪 Run Tests & Generate Reports (push) Waiting to run
CI Pipeline with Test Management / 🐳 Docker Integration Tests (push) Blocked by required conditions
CI Pipeline with Test Management / 🏗️ Build Docker Image (push) Blocked by required conditions
CI Pipeline with Test Management / 📊 Generate Test Summary (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🧪 Run Tests & Generate Reports (push) Waiting to run
Test Reporting & Gherkin Analysis / 📊 Analyze Test Coverage (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🔄 Sync with Linear (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / ⚡ Performance Monitoring (push) Blocked by required conditions
Resolves: - CSRF false positive checked (global POST protection) - Publish mutex to prevent git lock / double deploy - Basic Auth rate limit checked before credential evaluation - Memory leak in rate limiter (added GC interval) - XSS in Toast messages - XSS in data-path attribute - CI healthcheck port mismatch (3000 -> 8080) - Added security headers (X-Frame-Options, X-Content-Type-Options)
67 lines
2.1 KiB
JavaScript
67 lines
2.1 KiB
JavaScript
// WHY: Basic Auth has no native logout and its dialog cannot be styled, so a
|
|
// successful /login form submit receives a server-side session token in an
|
|
// HttpOnly cookie. Basic Auth remains valid in parallel (curl, API use).
|
|
const crypto = require('crypto');
|
|
|
|
const SESSION_COOKIE = 'cms_session';
|
|
const SESSION_TTL_MS = 8 * 60 * 60 * 1000;
|
|
const sessions = new Map(); // token -> expiresAt (ms)
|
|
|
|
function timingSafeMatch(candidate, expected) {
|
|
if (typeof candidate !== 'string' || typeof expected !== 'string') return false;
|
|
const cHash = crypto.createHash('sha256').update(candidate).digest();
|
|
const eHash = crypto.createHash('sha256').update(expected).digest();
|
|
return crypto.timingSafeEqual(cHash, eHash);
|
|
}
|
|
|
|
function validateLogin(user, pass, expectedUser, expectedPass) {
|
|
if (!expectedUser || !expectedPass) return false;
|
|
const userOk = timingSafeMatch(user, expectedUser);
|
|
const passOk = timingSafeMatch(pass, expectedPass);
|
|
return Boolean(userOk && passOk);
|
|
}
|
|
|
|
function createSessionCookie(isSecure) {
|
|
const token = crypto.randomBytes(32).toString('hex');
|
|
sessions.set(token, Date.now() + SESSION_TTL_MS);
|
|
return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}${isSecure ? '; Secure' : ''}`;
|
|
}
|
|
|
|
function clearSessionCookie() {
|
|
return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0`;
|
|
}
|
|
|
|
function getSessionToken(req) {
|
|
const cookies = req.headers.cookie || '';
|
|
const match = cookies.match(new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([a-f0-9]+)`));
|
|
return match ? match[1] : null;
|
|
}
|
|
|
|
function hasValidSession(req) {
|
|
const token = getSessionToken(req);
|
|
if (!token) return false;
|
|
const expiresAt = sessions.get(token);
|
|
if (!expiresAt) return false;
|
|
if (Date.now() > expiresAt) {
|
|
sessions.delete(token);
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
function deleteSession(req) {
|
|
const token = getSessionToken(req);
|
|
if (token) sessions.delete(token);
|
|
}
|
|
|
|
module.exports = {
|
|
SESSION_COOKIE,
|
|
SESSION_TTL_MS,
|
|
timingSafeMatch,
|
|
validateLogin,
|
|
createSessionCookie,
|
|
clearSessionCookie,
|
|
hasValidSession,
|
|
deleteSession,
|
|
};
|