Compare commits
6 Commits
ee35696cd4
...
0.5
| Author | SHA1 | Date | |
|---|---|---|---|
| 75e8640439 | |||
| dca8f74f25 | |||
| 21f272e9f0 | |||
| 5a2d3313e7 | |||
| 6081e42d14 | |||
| 0675ad8512 |
@ -72,23 +72,6 @@ $pageLayout['full_alt'] = <<<'FULL_ALT'
|
||||
</html>
|
||||
FULL_ALT;
|
||||
|
||||
$pageLayout['frames'] = <<<'FRAMES'
|
||||
<!DOCTYPE html>
|
||||
<html lang="nl">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<title>lucidAuth</title>
|
||||
<meta name="application-name" content="lucidAuth" />
|
||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
|
||||
<script src="misc/script.iframe.js"></script>
|
||||
<script>%1$s</script>
|
||||
</head>
|
||||
<body>
|
||||
%2$s
|
||||
</body>
|
||||
</html>
|
||||
FRAMES;
|
||||
|
||||
$contentLayout['login'] = <<<'LOGIN'
|
||||
<script src="misc/script.index.js"></script>
|
||||
<section>
|
||||
|
||||
@ -39,7 +39,8 @@
|
||||
"Result" => "Success",
|
||||
"Location" => $originalUri,
|
||||
"CrossDomainLogin" => $settings->Session['CrossDomainLogin'],
|
||||
"CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], $_SERVER['HTTP_HOST']))
|
||||
"CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], [$_SERVER['HTTP_HOST']])),
|
||||
"SecureToken" => $result['token']
|
||||
]);
|
||||
} else {
|
||||
switch ($result['reason']) {
|
||||
|
||||
@ -18,14 +18,21 @@
|
||||
switch ($queryString['action']) {
|
||||
case 'login':
|
||||
if (validateToken($queryString['token'])['status'] === "Success") {
|
||||
// This request appears valid; store a cookie
|
||||
// This request appears valid; try storing a cookie
|
||||
$httpHost = $_SERVER['HTTP_HOST'];
|
||||
$cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) {
|
||||
// Check if $_SERVER['HTTP_HOST'] matches any of the configured domains (either explicitly or as a subdomain)
|
||||
$httpOrigin = $_SERVER['HTTP_ORIGIN'];
|
||||
// Check if $_SERVER['HTTP_HOST'] and $_SERVER['HTTP_ORIGIN'] match any of the configured domains (either explicitly or as a subdomain)
|
||||
// This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks
|
||||
$cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) {
|
||||
return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value)));
|
||||
}))[0];
|
||||
if ($cookieDomain && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) {
|
||||
$originDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpOrigin) {
|
||||
return (strlen($value) > strlen($httpOrigin)) ? false : (0 === substr_compare($httpOrigin, $value, -strlen($value)));
|
||||
}))[0];
|
||||
if (($cookieDomain && (is_null($httpOrigin) || $originDomain)) && setcookie('JWT', $queryString['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain)) {
|
||||
header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
|
||||
header('Access-Control-Allow-Credentials: true');
|
||||
header('Access-Control-Max-Age: 86400');
|
||||
header("HTTP/1.1 202 Accepted");
|
||||
exit;
|
||||
}
|
||||
@ -31,28 +31,34 @@ $(document).ready(function(){
|
||||
'color': '#FFF'
|
||||
});
|
||||
if (data.CrossDomainLogin) {
|
||||
console.log('CrossDomainLogin initiated');
|
||||
// For reference:
|
||||
// [
|
||||
// "Result" => "Success",
|
||||
// "Location" => $originalUri,
|
||||
// "CrossDomainLogin" => $settings->Session['CrossDomainLogin'],
|
||||
// "CookieDomains" => json_encode(array_diff($settings->Session['CookieDomains'], $_SERVER['HTTP_HOST']))
|
||||
// ]);
|
||||
|
||||
var cookieDomains = json_decode(data.CookieDomains);
|
||||
console.log(data.CookieDomains);
|
||||
// let the client setup multiple iframes for all domains
|
||||
// psuedo-code: foreach (cookieDomains as domain) { $.get(domain, ref=[action,token])}
|
||||
|
||||
// validate each request against JWT-tokens in database
|
||||
// load all iframes parallel, show user progress and redirect once all iframes have finished loading; or after treshold of X ms has been reached
|
||||
// origin domain should be exempted from the treshold (because origin domain can be different from current domain -due to traefik design).
|
||||
|
||||
var cookieDomains = JSON.parse(data.CookieDomains);
|
||||
var XHR = [];
|
||||
cookieDomains.forEach(function(domain) {
|
||||
XHR.push($.get({
|
||||
url: "https://auth." + domain + "/lucidAuth.requestCookie.php",
|
||||
crossDomain: true,
|
||||
xhrFields: {
|
||||
withCredentials: true,
|
||||
},
|
||||
data: {
|
||||
ref: btoa(JSON.stringify({
|
||||
action: 'login',
|
||||
token: data.SecureToken
|
||||
}))
|
||||
}
|
||||
}));
|
||||
});
|
||||
$.when.apply($, XHR).then(function(){
|
||||
$.each(arguments, function(_index, _arg) {
|
||||
// Show progress somehow (maybe something like https://minicss.org/v2/progress)
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// Finished (either succesfully or through timeout) cross-domain logins
|
||||
window.location.replace(data.Location);
|
||||
// redirect once all finished loading or timeout after $X ms
|
||||
// origin domain should be exempted from timeout
|
||||
// (because origin domain can/will be different from current domain --due to traefik design).
|
||||
//window.location.replace(data.Location);
|
||||
}, 2250);
|
||||
} else {
|
||||
$('#btnlogin').css({
|
||||
|
||||
Reference in New Issue
Block a user