krgamestudios/auth-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Testing cookies

Browse Source
This commit is contained in:
Kayne Ruse
2022-07-25 15:55:58 +01:00
parent 76fdbc0d13
commit 678d55779d
12 changed files with 79 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-lock.json
Generated
+37
View File
@@ -10,6 +10,7 @@
"license": "ISC",
"dependencies": {
"bcryptjs": "^2.4.3",
"cookie-parser": "^1.4.6",
"cors": "^2.8.5",
"dotenv": "^8.6.0",
"express": "^4.17.1",
@@ -1700,6 +1701,26 @@
"node": ">= 0.6"
}
},
"node_modules/cookie-parser": {
"version": "1.4.6",
"resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz",
"integrity": "sha512-z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==",
"dependencies": {
"cookie": "0.4.1",
"cookie-signature": "1.0.6"
},
"engines": {
"node": ">= 0.8.0"
}
},
"node_modules/cookie-parser/node_modules/cookie": {
"version": "0.4.1",
"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz",
"integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==",
"engines": {
"node": ">= 0.6"
}
},
"node_modules/cookie-signature": {
"version": "1.0.6",
"resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -6682,6 +6703,22 @@
"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
"integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw=="
},
"cookie-parser": {
"version": "1.4.6",
"resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz",
"integrity": "sha512-z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==",
"requires": {
"cookie": "0.4.1",
"cookie-signature": "1.0.6"
},
"dependencies": {
"cookie": {
"version": "0.4.1",
"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz",
"integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA=="
}
}
},
"cookie-signature": {
"version": "1.0.6",
"resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
package.json
+1
View File
@@ -21,6 +21,7 @@
"homepage": "https://github.com/krgamestudios/auth-server#readme",
"dependencies": {
"bcryptjs": "^2.4.3",
"cookie-parser": "^1.4.6",
"cors": "^2.8.5",
"dotenv": "^8.6.0",
"express": "^4.17.1",
server/admin/default-account.js
+1 -1
View File
@@ -25,7 +25,7 @@ module.exports = async () => {
});
if (adminRecord == null) {
const webAddress = process.env.WEB_ADDRESS == 'localhost' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
const webAddress = process.env.WEB_ADDRESS == 'localhost:3000' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
await accounts.create({
email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
username: `${process.env.ADMIN_DEFAULT_USERNAME}`,
server/auth/login.js
+6 -3
View File
@@ -3,7 +3,7 @@ const utils = require('util');
const bcrypt = require('bcryptjs');
const { accounts } = require('../database/models');
const tokenGenerate = require('../utilities/token-generate');
const tokenGenerateRefresh = require('../utilities/token-generate-refresh');
//utilities
const validateEmail = require('../utilities/validate-email');
@@ -49,10 +49,13 @@ const route = async (req, res) => {
}
//generate the JWTs
const tokens = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
const { accessToken, refreshToken } = tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
//set the cookie
res.cookie('refreshToken', refreshToken, { httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 }); //30 days
//finally
res.status(200).json(tokens);
res.status(200).send(accessToken);
return null;
};
server/auth/logout.js
+3 -1
View File
@@ -2,7 +2,9 @@ const tokenDestroy = require('../utilities/token-destroy');
//auth/logout
const route = (req, res) => {
tokenDestroy(req.body.token);
//stored in the cookie
console.log(req.cookies.refreshToken)
tokenDestroy(req.cookies.refreshToken);
return res.status(200).end();
};
server/auth/token.js
+6 -3
View File
@@ -4,13 +4,16 @@ const tokenRefresh = require('../utilities/token-refresh');
//auth/token
module.exports = async (req, res) => {
const refreshToken = req.body.token;
console.log(req.cookies);
return tokenRefresh(refreshToken, (err, token) => {
return tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
if (err) {
return res.status(err).end();
}
return res.status(200).send(token);
//set the cookie
res.cookie('refreshToken', refreshToken, { httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 }); //30 days
return res.status(200).send(accessToken);
});
};
server/server.js
+10 -1
View File
@@ -6,10 +6,19 @@ const express = require('express');
const app = express();
const server = require('http').Server(app);
const cors = require('cors');
const cookieParser = require('cookie-parser');
//config
app.use(express.json());
app.use(cors());
app.use(cors({
credentials: true,
// origin: `${process.env.WEB_PROTOCOL}://${process.env.WEB_ADDRESS}`,
origin: true,
methods: ['HEAD', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'TRACE', 'OPTIONS']
}));
app.use(cookieParser());
//database connection
const database = require('./database');
server/utilities/token-auth.js
+4 -4
View File
@@ -3,13 +3,13 @@ const jwt = require('jsonwebtoken');
//middleware to authenticate the JWT token
module.exports = (req, res, next) => {
const authHeader = req.headers['authorization'];
const token = authHeader?.split(' ')[1]; //'Bearer token'
const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
if (!token) {
return res.status(401).send('No token found');
if (!accessToken) {
return res.status(401).send('No access token found');
}
return jwt.verify(token, process.env.SECRET_ACCESS, (err, user) => {
return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {
if (err) {
return res.status(403).send(err);
}
server/utilities/token-destroy.js
+2 -2
View File
@@ -1,9 +1,9 @@
const { tokens } = require('../database/models');
module.exports = (token) => {
module.exports = (refreshToken) => {
tokens.destroy({
where: {
token: token || ''
token: refreshToken || ''
}
});
}
server/utilities/token-generate.js → server/utilities/token-generate-refresh.js
+1 -1
View File
@@ -13,7 +13,7 @@ module.exports = (index, email, username, type, admin, mod) => {
};
//these are strings
const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '1s', issuer: 'auth' });
const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
tokens.create({ token: refreshToken, email: email });
server/utilities/token-refresh.js
+8 -8
View File
@@ -1,17 +1,17 @@
const jwt = require('jsonwebtoken');
const { tokens } = require('../database/models');
const generate = require('./token-generate');
const generate = require('./token-generate-refresh');
const destroy = require('./token-destroy');
module.exports = async (token, callback) => {
if (!token) {
module.exports = async (oldRefreshToken, callback) => {
if (!oldRefreshToken) {
return callback(401);
}
const tokenRecord = await tokens.findOne({
where: {
token: token || ''
token: oldRefreshToken || ''
}
});
@@ -19,15 +19,15 @@ module.exports = async (token, callback) => {
return callback(403);
}
jwt.verify(token, process.env.SECRET_REFRESH, (err, user) => {
jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, (err, user) => {
if (err) {
return callback(403);
}
const result = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
const { accessToken, refreshToken } = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
destroy(token);
destroy(oldRefreshToken);
return callback(null, result);
return callback(null, accessToken, refreshToken);
});
};
tools/react/token-provider.jsx
-124
View File
@@ -1,124 +0,0 @@
import React, { useState, useEffect, createContext } from 'react';
import decode from 'jwt-decode';
export const TokenContext = createContext();
//DOCS: tokenFetch() and tokenCallback() are actually closures here
const TokenProvider = props => {
//state to be used
const [accessToken, setAccessToken] = useState('');
const [refreshToken, setRefreshToken] = useState('');
//make the access and refresh tokens persist between reloads
useEffect(() => {
setAccessToken(localStorage.getItem("accessToken") || '');
setRefreshToken(localStorage.getItem("refreshToken") || '');
}, []);
//update the stored copies
useEffect(() => {
localStorage.setItem("accessToken", accessToken);
localStorage.setItem("refreshToken", refreshToken);
}, [accessToken, refreshToken]);
//wrap the default fetch function
const tokenFetch = async (url, options) => {
//use this?
let bearer = accessToken;
//if expired (10 minutes, normally)
const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
if (expired) {
//BUGFIX: if logging out, just skip over the refresh token
if (url === `${process.env.AUTH_URI}/auth/logout`) {
return fetch(url, {
method: 'DELETE',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${bearer}`
},
body: JSON.stringify({
token: refreshToken
})
});
}
//ping the auth server for a new token
const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify({
token: refreshToken
})
});
//any errors, throw them
if (!response.ok) {
throw `${response.status}: ${await response.text()}`;
}
//save the new auth stuff (setting bearer as well)
const newAuth = await response.json();
setAccessToken(newAuth.accessToken);
setRefreshToken(newAuth.refreshToken);
bearer = newAuth.accessToken;
}
//finally, delegate to fetch
return fetch(url, {
...(options || {}),
headers: {
...(options || { headers: {} }).headers,
'Authorization': `Bearer ${bearer}`
}
});
};
//access the refreshed token via callback
const tokenCallback = async (cb) => {
//if expired (10 minutes, normally)
const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
if (expired) {
//ping the auth server for a new token
const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify({
token: refreshToken
})
});
//any errors, throw them
if (!response.ok) {
throw `${response.status}: ${await response.text()}`;
}
//save the new auth stuff (setting bearer as well)
const newAuth = await response.json();
setAccessToken(newAuth.accessToken);
setRefreshToken(newAuth.refreshToken);
//finally
return cb(newAuth.accessToken);
} else {
return cb(accessToken);
}
};
return (
<TokenContext.Provider value={{ accessToken, refreshToken, setAccessToken, setRefreshToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
{props.children}
</TokenContext.Provider>
)
};
export default TokenProvider;