cpvalente/ontime
1
0
Fork 0
mirror of https://github.com/cpvalente/ontime.git synced 2026-08-15 12:23:51 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity

refactor: set token from query params

Browse Source
This commit is contained in:
Carlos Valente
2025-01-16 21:41:16 +01:00
committed by Carlos Valente
parent 7fe5223af9
commit 0450eb9169
3 changed files with 25 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/server/src/middleware/authenticate.ts
+22 -32
View File
@@ -8,8 +8,7 @@ import { parse as parseCookie } from 'cookie';
import { hashPassword } from '../utils/hash.js';
import { srcFiles } from '../setup/index.js';
import { logger } from '../classes/Logger.js';
// import { password } from '../externals.js';
const password = 'test';
import { password } from '../externals.js';
import { noopMiddleware } from './noop.js';
export const hasPassword = Boolean(password);
@@ -19,7 +18,13 @@ const hashedPassword = hasPassword ? hashPassword(password) : '';
* List of public assets that can be accessed without authentication
* should match the files in client/public
*/
const publicAssets = ['/favicon.ico', '/manifest.json', '/ontime-logo.png', '/robots.txt', '/site.webmanifest'];
const publicAssets = new Set([
'/favicon.ico',
'/manifest.json',
'/ontime-logo.png',
'/robots.txt',
'/site.webmanifest',
]);
export const loginRouter = express.Router();
@@ -31,23 +36,8 @@ loginRouter.post('/', (req, res) => {
res.clearCookie('token');
const { password: reqPassword, redirect } = req.body;
if (!hasPassword) {
res.redirect(redirect || '/');
return;
}
if (!reqPassword) {
res.status(401).send('Unauthorized');
return;
}
if (hashPassword(reqPassword) === hashedPassword) {
res.cookie('token', hashedPassword, {
httpOnly: false, // allow websocket to access cookie
secure: true,
path: '/', // allow cookie to be accessed from any path
sameSite: 'strict',
});
setSessionCookie(res, hashedPassword);
res.redirect(redirect || '/');
return;
}
@@ -76,12 +66,12 @@ export function makeAuthenticateMiddleware(prefix: string) {
function authenticateAndRedirect(req: Request, res: Response, next: NextFunction) {
// Allow access to specific public assets without authentication
if (publicAssets.includes(req.originalUrl)) {
if (publicAssets.has(req.originalUrl)) {
return next();
}
// we shouldnt be here in the login route
if (req.originalUrl.startsWith('/login')) {
// cannot authenticate the login route
return next();
}
@@ -93,20 +83,11 @@ export function makeAuthenticateMiddleware(prefix: string) {
// we use query params for generating authenticated URLs and for clients like the companion module
// if the user gives is a token in the query params, we set the cookie to be used in further requests
if (req.query.token === hashedPassword) {
res.cookie('token', hashedPassword, {
httpOnly: false, // allow websocket to access cookie
secure: true,
path: '/', // allow cookie to be accessed from any path
sameSite: 'strict',
});
setSessionCookie(res, hashedPassword);
return next();
}
const redirect = req.originalUrl.startsWith('/login')
? `${prefix}/login`
: `${prefix}/login?redirect=${req.originalUrl}`;
res.redirect(redirect);
res.redirect(`${prefix}/login?redirect=${req.originalUrl}`);
}
return { authenticate, authenticateAndRedirect };
@@ -139,3 +120,12 @@ export function authenticateSocket(_ws: WebSocket, req: IncomingMessage, next: (
logger.warning(LogOrigin.Client, 'Unauthorized WebSocket connection attempt');
return next(new Error('Unauthorized'));
}
function setSessionCookie(res: Response, token: string) {
res.cookie('token', token, {
httpOnly: false, // allow websocket to access cookie
secure: true,
path: '/', // allow cookie to be accessed from any path
sameSite: 'strict',
});
}