From e3405369cab7968eea6a330a6fd7cdd3a18fe96e Mon Sep 17 00:00:00 2001 From: Danny Bessems Date: Wed, 13 Mar 2019 10:53:22 +0000 Subject: [PATCH 1/6] Delete 'public/misc/script.theme.js' --- public/misc/script.theme.js | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 public/misc/script.theme.js diff --git a/public/misc/script.theme.js b/public/misc/script.theme.js deleted file mode 100644 index 5532021..0000000 --- a/public/misc/script.theme.js +++ /dev/null @@ -1,19 +0,0 @@ -$(document).ready(function() { - if (localStorage.getItem('theme') != '') { - $('html').addClass(localStorage.getItem('theme')); - } - - $('.logo .sub').on('click', function(event) { - if (event.ctrlKey) { - var classes = ["tablecloth", "weave", "madras", "tartan", "seigaiha"]; - var selectedTheme = classes[~~(Math.random()*classes.length)]; - - $('html').removeClass().addClass(selectedTheme); - localStorage.setItem('theme', selectedTheme); - } - if (event.altKey) { - $('html').removeClass(); - localStorage.removeItem('theme'); - } - }); -}); \ No newline at end of file From ee35696cd42bb3b4a4515611b8a497fd2c6866da Mon Sep 17 00:00:00 2001 From: Danny Bessems Date: Tue, 18 Jun 2019 13:21:44 +0000 Subject: [PATCH 2/6] Controller for cross-domain iframes added --- include/lucidAuth.template.php | 7 +++-- public/lucidAuth.login.php | 11 +++---- public/lucidAuth.setXDomainCookie.php | 45 +++++++++++++++++---------- public/lucidAuth.validateRequest.php | 4 +-- public/misc/script.index.js | 21 +++++++++++-- 5 files changed, 58 insertions(+), 30 deletions(-) diff --git a/include/lucidAuth.template.php b/include/lucidAuth.template.php index e1b45b6..b823a3b 100644 --- a/include/lucidAuth.template.php +++ b/include/lucidAuth.template.php @@ -72,7 +72,7 @@ $pageLayout['full_alt'] = <<<'FULL_ALT' FULL_ALT; -$pageLayout['bare'] = <<<'BARE' +$pageLayout['frames'] = <<<'FRAMES' @@ -81,12 +81,13 @@ $pageLayout['bare'] = <<<'BARE' + - %1$s + %2$s -BARE; +FRAMES; $contentLayout['login'] = <<<'LOGIN' diff --git a/public/lucidAuth.login.php b/public/lucidAuth.login.php index cf55df8..d864fdb 100644 --- a/public/lucidAuth.login.php +++ b/public/lucidAuth.login.php @@ -14,10 +14,9 @@ "Result" => "Failure", "Reason" => "Failed storing authentication token in database and/or cookie" ]); -# echo '{"Result":"Fail","Reason":"Failed storing authentication token in database and/or cookie"}' . PHP_EOL; exit; } - + // Convert base64 encoded string back from JSON; // forcing it into an associative array (instead of javascript's default StdClass object) try { @@ -30,7 +29,6 @@ "Result" => "Failure", "Reason" => "Original request-URI lost in transition" ]); -# echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL; exit; } $originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php'; @@ -40,7 +38,8 @@ echo json_encode([ "Result" => "Success", "Location" => $originalUri, - "CrossDomainLogin" => $settings->Session['CrossDomainLogin'] + "CrossDomainLogin" => $settings->Session['CrossDomainLogin'], + "CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], $_SERVER['HTTP_HOST'])) ]); } else { switch ($result['reason']) { @@ -63,8 +62,8 @@ } else { include_once('../include/lucidAuth.template.php'); - echo sprintf($pageLayout['full'], - sprintf($contentLayout['login'], + echo sprintf($pageLayout['full'], + sprintf($contentLayout['login'], $_GET['ref'] ) ); diff --git a/public/lucidAuth.setXDomainCookie.php b/public/lucidAuth.setXDomainCookie.php index 0d20746..9dffc41 100644 --- a/public/lucidAuth.setXDomainCookie.php +++ b/public/lucidAuth.setXDomainCookie.php @@ -4,38 +4,49 @@ include_once('../include/lucidAuth.functions.php'); // Start with checking $_REQUEST['ref'] - // What do we need? - // token again? - - // approach 1: - // origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already) - // this might be slower because it means one additional roundtrip between client and server - - // approach 2: - // let the client setup multiple iframes for all domains other than origin domains - // this requires passing an array of domains to the client in asynchronous reply; which feels insecure - if (!empty($_REQUEST['ref'])) { try { $queryString = json_decode(base64_decode($_REQUEST['ref']), JSON_OBJECT_AS_ARRAY); } catch (Exception $e) { // Silently fail, unless explicitly specified otherwise + header("HTTP/1.1 400 Bad Request"); if ($settings->Debug['Verbose']) throw new Exception($e); exit; } switch ($queryString['action']) { case 'login': + if (validateToken($queryString['token'])['status'] === "Success") { + // This request appears valid; store a cookie + $httpHost = $_SERVER['HTTP_HOST']; + $cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) { + // Check if $_SERVER['HTTP_HOST'] matches any of the configured domains (either explicitly or as a subdomain) + // This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks + return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value))); + }))[0]; + if ($cookieDomain && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) { + header("HTTP/1.1 202 Accepted"); + exit; + } + else { + header("HTTP/1.1 400 Bad Request"); + exit; + } + } + else { + header("HTTP/1.1 401 Unauthorized"); + exit; + } break; default: + header("HTTP/1.1 400 Bad Request"); + exit; break; } } - - include_once('../include/lucidAuth.template.php'); - - echo sprintf($pageLayout['bare'], - '// iFrames go here' - ); + else { + header("HTTP/1.1 400 Bad Request"); + exit; + } ?> \ No newline at end of file diff --git a/public/lucidAuth.validateRequest.php b/public/lucidAuth.validateRequest.php index 289561d..ef68ff0 100644 --- a/public/lucidAuth.validateRequest.php +++ b/public/lucidAuth.validateRequest.php @@ -14,7 +14,7 @@ $proxyHeaders = array_filter($proxyHeaders, function ($key) { return substr($key, 0, 10) === 'XForwarded'; }, ARRAY_FILTER_USE_KEY); - + // For debugging purposes - enable it in ../lucidAuth.config.php if ($settings->Debug['LogToFile']) { file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT)) . PHP_EOL, FILE_APPEND); @@ -22,7 +22,7 @@ if (sizeof($proxyHeaders) === 0) { // Non-proxied request; this is senseless, go fetch! - header("HTTP/1.1 403 Forbidden"); + header("HTTP/1.1 400 Bad Request"); exit; } diff --git a/public/misc/script.index.js b/public/misc/script.index.js index 746d489..05aec5b 100644 --- a/public/misc/script.index.js +++ b/public/misc/script.index.js @@ -31,10 +31,27 @@ $(document).ready(function(){ 'color': '#FFF' }); if (data.CrossDomainLogin) { - // Create iframes for other domains console.log('CrossDomainLogin initiated'); +// For reference: +// [ +// "Result" => "Success", +// "Location" => $originalUri, +// "CrossDomainLogin" => $settings->Session['CrossDomainLogin'], +// "CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], $_SERVER['HTTP_HOST'])) +// ]); + + var cookieDomains = json_decode(data.CookieDomains); + console.log(data.CookieDomains); +// let the client setup multiple iframes for all domains +// psuedo-code: foreach (cookieDomains as domain) { $.get(domain, ref=[action,token])} + + // validate each request against JWT-tokens in database + // load all iframes parallel, show user progress and redirect once all iframes have finished loading; or after treshold of X ms has been reached + // origin domain should be exempted from the treshold (because origin domain can be different from current domain -due to traefik design). + } -console.log("Navigating to :" + data.Location); + + // Finished (either succesfully or through timeout) cross-domain logins window.location.replace(data.Location); }, 2250); } else { From 0675ad8512159712fcbf1d3d40231b580c066e71 Mon Sep 17 00:00:00 2001 From: Danny Bessems Date: Wed, 19 Jun 2019 10:09:46 +0000 Subject: [PATCH 3/6] Controller for cross-domain iframes added --- include/lucidAuth.template.php | 7 ++-- public/lucidAuth.login.php | 12 +++---- public/lucidAuth.setXDomainCookie.php | 50 ++++++++++++++++++--------- public/lucidAuth.validateRequest.php | 4 +-- public/misc/script.index.js | 29 ++++++++++++++-- 5 files changed, 71 insertions(+), 31 deletions(-) diff --git a/include/lucidAuth.template.php b/include/lucidAuth.template.php index e1b45b6..b823a3b 100644 --- a/include/lucidAuth.template.php +++ b/include/lucidAuth.template.php @@ -72,7 +72,7 @@ $pageLayout['full_alt'] = <<<'FULL_ALT' FULL_ALT; -$pageLayout['bare'] = <<<'BARE' +$pageLayout['frames'] = <<<'FRAMES' @@ -81,12 +81,13 @@ $pageLayout['bare'] = <<<'BARE' + - %1$s + %2$s -BARE; +FRAMES; $contentLayout['login'] = <<<'LOGIN' diff --git a/public/lucidAuth.login.php b/public/lucidAuth.login.php index cf55df8..4af3a1c 100644 --- a/public/lucidAuth.login.php +++ b/public/lucidAuth.login.php @@ -14,10 +14,9 @@ "Result" => "Failure", "Reason" => "Failed storing authentication token in database and/or cookie" ]); -# echo '{"Result":"Fail","Reason":"Failed storing authentication token in database and/or cookie"}' . PHP_EOL; exit; } - + // Convert base64 encoded string back from JSON; // forcing it into an associative array (instead of javascript's default StdClass object) try { @@ -30,7 +29,6 @@ "Result" => "Failure", "Reason" => "Original request-URI lost in transition" ]); -# echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL; exit; } $originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php'; @@ -40,7 +38,9 @@ echo json_encode([ "Result" => "Success", "Location" => $originalUri, - "CrossDomainLogin" => $settings->Session['CrossDomainLogin'] + "CrossDomainLogin" => $settings->Session['CrossDomainLogin'], + "CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], [$_SERVER['HTTP_HOST']])), + "SecureToken" => $result['token'] ]); } else { switch ($result['reason']) { @@ -63,8 +63,8 @@ } else { include_once('../include/lucidAuth.template.php'); - echo sprintf($pageLayout['full'], - sprintf($contentLayout['login'], + echo sprintf($pageLayout['full'], + sprintf($contentLayout['login'], $_GET['ref'] ) ); diff --git a/public/lucidAuth.setXDomainCookie.php b/public/lucidAuth.setXDomainCookie.php index 0d20746..20835e4 100644 --- a/public/lucidAuth.setXDomainCookie.php +++ b/public/lucidAuth.setXDomainCookie.php @@ -4,38 +4,54 @@ include_once('../include/lucidAuth.functions.php'); // Start with checking $_REQUEST['ref'] - // What do we need? - // token again? - - // approach 1: - // origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already) - // this might be slower because it means one additional roundtrip between client and server - - // approach 2: - // let the client setup multiple iframes for all domains other than origin domains - // this requires passing an array of domains to the client in asynchronous reply; which feels insecure - if (!empty($_REQUEST['ref'])) { try { $queryString = json_decode(base64_decode($_REQUEST['ref']), JSON_OBJECT_AS_ARRAY); } catch (Exception $e) { // Silently fail, unless explicitly specified otherwise + header("HTTP/1.1 400 Bad Request"); if ($settings->Debug['Verbose']) throw new Exception($e); exit; } switch ($queryString['action']) { case 'login': + if (validateToken($queryString['token'])['status'] === "Success") { + // This request appears valid; try storing a cookie + $httpHost = $_SERVER['HTTP_HOST']; + $httpOrigin = $_SERVER['HTTP_ORIGIN']; + // Check if $_SERVER['HTTP_HOST'] and $_SERVER['HTTP_ORIGIN'] match any of the configured domains (either explicitly or as a subdomain) + // This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks + $cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) { + return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value))); + }))[0]; + $originDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpOrigin) { + return (strlen($value) > strlen($httpOrigin)) ? false : (0 === substr_compare($httpOrigin, $value, -strlen($value))); + }))[0]; + if (($cookieDomain && (is_null($httpOrigin) || $originDomain)) && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) { + header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}"); + header("HTTP/1.1 202 Accepted"); + exit; + } + else { + header("HTTP/1.1 400 Bad Request"); + exit; + } + } + else { + header("HTTP/1.1 401 Unauthorized"); + exit; + } break; default: + header("HTTP/1.1 400 Bad Request"); + exit; break; } } - - include_once('../include/lucidAuth.template.php'); - - echo sprintf($pageLayout['bare'], - '// iFrames go here' - ); + else { + header("HTTP/1.1 400 Bad Request"); + exit; + } ?> \ No newline at end of file diff --git a/public/lucidAuth.validateRequest.php b/public/lucidAuth.validateRequest.php index 289561d..ef68ff0 100644 --- a/public/lucidAuth.validateRequest.php +++ b/public/lucidAuth.validateRequest.php @@ -14,7 +14,7 @@ $proxyHeaders = array_filter($proxyHeaders, function ($key) { return substr($key, 0, 10) === 'XForwarded'; }, ARRAY_FILTER_USE_KEY); - + // For debugging purposes - enable it in ../lucidAuth.config.php if ($settings->Debug['LogToFile']) { file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT)) . PHP_EOL, FILE_APPEND); @@ -22,7 +22,7 @@ if (sizeof($proxyHeaders) === 0) { // Non-proxied request; this is senseless, go fetch! - header("HTTP/1.1 403 Forbidden"); + header("HTTP/1.1 400 Bad Request"); exit; } diff --git a/public/misc/script.index.js b/public/misc/script.index.js index 746d489..6c84779 100644 --- a/public/misc/script.index.js +++ b/public/misc/script.index.js @@ -31,11 +31,34 @@ $(document).ready(function(){ 'color': '#FFF' }); if (data.CrossDomainLogin) { - // Create iframes for other domains console.log('CrossDomainLogin initiated'); +// do ajax in parallel, show progress, +// redirect once all finished loading or timeout after $X ms +// origin domain should be exempted from timeout +// (because origin domain can/will be different from current domain --due to traefik design). + + var cookieDomains = JSON.parse(data.CookieDomains); + var XHR = []; + cookieDomains.forEach(function(domain) { + XHR.push($.get({ + url: "https://auth." + domain + "/lucidAuth.setXDomainCookie.php", + crossDomain: true, + data: { + ref: btoa(JSON.stringify({ + action: 'login', + token: data.SecureToken + })) + } + })); + }); + $.when.apply($, XHR).then(function(){ + $.each(arguments, function(_index, arg) { + console.log(JSON.stringify(arg)); + }); + }); } -console.log("Navigating to :" + data.Location); - window.location.replace(data.Location); + // Finished (either succesfully or through timeout) cross-domain logins + //window.location.replace(data.Location); }, 2250); } else { $('#btnlogin').css({ From 5a2d3313e75610b6edefe14db7eea8577c0d1ed2 Mon Sep 17 00:00:00 2001 From: Danny Bessems Date: Wed, 19 Jun 2019 10:34:31 +0000 Subject: [PATCH 4/6] Added missing CORS headers and xhrFields --- public/lucidAuth.setXDomainCookie.php | 2 ++ public/misc/script.index.js | 3 +++ 2 files changed, 5 insertions(+) diff --git a/public/lucidAuth.setXDomainCookie.php b/public/lucidAuth.setXDomainCookie.php index 20835e4..409f524 100644 --- a/public/lucidAuth.setXDomainCookie.php +++ b/public/lucidAuth.setXDomainCookie.php @@ -31,6 +31,8 @@ }))[0]; if (($cookieDomain && (is_null($httpOrigin) || $originDomain)) && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) { header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}"); + header('Access-Control-Allow-Credentials: true'); + header('Access-Control-Max-Age: 86400'); header("HTTP/1.1 202 Accepted"); exit; } diff --git a/public/misc/script.index.js b/public/misc/script.index.js index 6c84779..effe79c 100644 --- a/public/misc/script.index.js +++ b/public/misc/script.index.js @@ -43,6 +43,9 @@ console.log('CrossDomainLogin initiated'); XHR.push($.get({ url: "https://auth." + domain + "/lucidAuth.setXDomainCookie.php", crossDomain: true, + xhrFields: { + withCredentials: true, + }, data: { ref: btoa(JSON.stringify({ action: 'login', From 21f272e9f08ea2788b44ba9a92037c38427c8e60 Mon Sep 17 00:00:00 2001 From: Danny Bessems Date: Wed, 19 Jun 2019 10:37:20 +0000 Subject: [PATCH 5/6] Renamed file to reflect actual purpose --- ...etXDomainCookie.php => lucidAuth.requestCookie.php} | 0 public/misc/script.iframe.js | 10 ---------- public/misc/script.index.js | 2 +- 3 files changed, 1 insertion(+), 11 deletions(-) rename public/{lucidAuth.setXDomainCookie.php => lucidAuth.requestCookie.php} (100%) delete mode 100644 public/misc/script.iframe.js diff --git a/public/lucidAuth.setXDomainCookie.php b/public/lucidAuth.requestCookie.php similarity index 100% rename from public/lucidAuth.setXDomainCookie.php rename to public/lucidAuth.requestCookie.php diff --git a/public/misc/script.iframe.js b/public/misc/script.iframe.js deleted file mode 100644 index d6bfb93..0000000 --- a/public/misc/script.iframe.js +++ /dev/null @@ -1,10 +0,0 @@ -$(document).ready(function(){ - $.post("lucidAuth.setXDomainCookie.php", { - do: "login", - ref: $('#ref').val() - }) - .done(function(data,_status) { - if (data.Result === 'Success') { - } - }); -}); \ No newline at end of file diff --git a/public/misc/script.index.js b/public/misc/script.index.js index effe79c..5f555d7 100644 --- a/public/misc/script.index.js +++ b/public/misc/script.index.js @@ -41,7 +41,7 @@ console.log('CrossDomainLogin initiated'); var XHR = []; cookieDomains.forEach(function(domain) { XHR.push($.get({ - url: "https://auth." + domain + "/lucidAuth.setXDomainCookie.php", + url: "https://auth." + domain + "/lucidAuth.requestCookie.php", crossDomain: true, xhrFields: { withCredentials: true, From dca8f74f25a0996701dc987f282412152fa49d08 Mon Sep 17 00:00:00 2001 From: Danny Bessems Date: Wed, 19 Jun 2019 10:55:01 +0000 Subject: [PATCH 6/6] Minor edits (housekeeping) --- include/lucidAuth.template.php | 17 ----------------- public/misc/script.index.js | 13 +++++-------- 2 files changed, 5 insertions(+), 25 deletions(-) diff --git a/include/lucidAuth.template.php b/include/lucidAuth.template.php index b823a3b..a4146eb 100644 --- a/include/lucidAuth.template.php +++ b/include/lucidAuth.template.php @@ -72,23 +72,6 @@ $pageLayout['full_alt'] = <<<'FULL_ALT' FULL_ALT; -$pageLayout['frames'] = <<<'FRAMES' - - - - - lucidAuth - - - - - - - %2$s - - -FRAMES; - $contentLayout['login'] = <<<'LOGIN'
diff --git a/public/misc/script.index.js b/public/misc/script.index.js index 5f555d7..1fd11cc 100644 --- a/public/misc/script.index.js +++ b/public/misc/script.index.js @@ -31,12 +31,6 @@ $(document).ready(function(){ 'color': '#FFF' }); if (data.CrossDomainLogin) { -console.log('CrossDomainLogin initiated'); -// do ajax in parallel, show progress, -// redirect once all finished loading or timeout after $X ms -// origin domain should be exempted from timeout -// (because origin domain can/will be different from current domain --due to traefik design). - var cookieDomains = JSON.parse(data.CookieDomains); var XHR = []; cookieDomains.forEach(function(domain) { @@ -55,12 +49,15 @@ console.log('CrossDomainLogin initiated'); })); }); $.when.apply($, XHR).then(function(){ - $.each(arguments, function(_index, arg) { - console.log(JSON.stringify(arg)); + $.each(arguments, function(_index, _arg) { + // Show progress somehow (maybe something like https://minicss.org/v2/progress) }); }); } // Finished (either succesfully or through timeout) cross-domain logins +// redirect once all finished loading or timeout after $X ms +// origin domain should be exempted from timeout +// (because origin domain can/will be different from current domain --due to traefik design). //window.location.replace(data.Location); }, 2250); } else {