Fixed origin issue in production environment

README.md

@@ -46,41 +46,35 @@ Content-Type: application/json
 }
 
 //DOCS: Result (access token's value is your authorization key below)
+Set-Cookie: refreshToken
+
 {
-	"accessToken": "abcde",
-	"refreshToken": "fghij"
+	"accessToken": "abcde"
 }
 
 
 ###
 
 
-//DOCS: Replace an expired authToken pair with new values
+//DOCS: Replace an expired accessToken with a new value
 POST /auth/token
-Content-Type: application/json
-
-{
-	"token": "refreshToken"
-}
+Cookie: refreshToken
 
 //DOCS: Result
+Set-Cookie: refreshToken
+
 {
-	"accessToken": "abcde",
-	"refreshToken": "fghij"
+	"accessToken": "abcde"
 }
 
 
 ###
 
 
-//DOCS: After this is called, the refresh route will no longer work
+//DOCS: After this is called, the /auth/token route will no longer work
 DELETE /auth/logout
 Authorization: Bearer accessToken
-
-{
-	"token": "refreshToken"
-}
-
+Cookie: refreshToken
 
 ###
 

configure-script.js

@@ -29,7 +29,8 @@ const question = (prompt, def = null) => {
 (async () => {
 	//project configuration
 	const appName = await question('App Name', 'auth');
-	const appWebAddress = await question('Web Addr', `${appName}.example.com`);
+	const appWebOrigin = await question('Web Origin', `example.com`);
+	const appWebAddress = await question('Web Addr', `${appName}.${appWebOrigin}`);
 	const postValidationHookArray = await question('Post Validation Hook Array', '');
 	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
@@ -70,6 +71,7 @@ services:
       - "traefik.http.services.${appName}service.loadbalancer.server.port=${appPort}"
     environment:
       - WEB_PROTOCOL=https
+      - WEB_ORIGIN=${appWebOrigin}
       - WEB_ADDRESS=${appWebAddress}
       - HOOK_POST_VALIDATION_ARRAY=${postValidationHookArray}
       - WEB_RESET_ADDRESS=${resetAddress}

package-lock.json

@@ -1,15 +1,16 @@
 {
   "name": "auth-server",
-  "version": "1.4.14",
+  "version": "1.6.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "auth-server",
-      "version": "1.4.14",
+      "version": "1.6.1",
       "license": "ISC",
       "dependencies": {
         "bcryptjs": "^2.4.3",
+        "cookie-parser": "^1.4.6",
         "cors": "^2.8.5",
         "dotenv": "^8.6.0",
         "express": "^4.17.1",
@@ -1056,9 +1057,9 @@
       "integrity": "sha512-iiUgKzV9AuaEkZqkOLDIvlQiL6ltuZd9tGcW3gwpnX8JbuiuhFlEGmmFXEXkN50Cvq7Os88IY2v0dkDqXYWVgA=="
     },
     "node_modules/@types/node": {
-      "version": "18.0.6",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.0.6.tgz",
-      "integrity": "sha512-/xUq6H2aQm261exT6iZTMifUySEt4GR5KX8eYyY+C4MSNPqSh9oNIP7tz2GLKTlFaiBbgZNxffoR3CVRG+cljw=="
+      "version": "18.6.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.6.1.tgz",
+      "integrity": "sha512-z+2vB6yDt1fNwKOeGbckpmirO+VBDuQqecXkgeIqDlaOtmKn6hPR/viQ8cxCfqLU4fTlvM3+YjM367TukWdxpg=="
     },
     "node_modules/@types/prettier": {
       "version": "2.6.3",
@@ -1516,9 +1517,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001369",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001369.tgz",
-      "integrity": "sha512-OY1SBHaodJc4wflDIKnlkdqWzJZd1Ls/2zbVJHBSv3AT7vgOJ58yAhd2CN4d57l2kPJrgMb7P9+N1Mhy4tNSQA==",
+      "version": "1.0.30001370",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001370.tgz",
+      "integrity": "sha512-3PDmaP56wz/qz7G508xzjx8C+MC2qEm4SYhSEzC9IBROo+dGXFWRuaXkWti0A9tuI00g+toiriVqxtWMgl350g==",
       "dev": true,
       "funding": [
         {
@@ -1693,13 +1694,25 @@
       "dev": true
     },
     "node_modules/cookie": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
-      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz",
+      "integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==",
       "engines": {
         "node": ">= 0.6"
       }
     },
+    "node_modules/cookie-parser": {
+      "version": "1.4.6",
+      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz",
+      "integrity": "sha512-z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==",
+      "dependencies": {
+        "cookie": "0.4.1",
+        "cookie-signature": "1.0.6"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
     "node_modules/cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
@@ -1904,9 +1917,9 @@
       "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.4.199",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.199.tgz",
-      "integrity": "sha512-WIGME0Cs7oob3mxsJwHbeWkH0tYkIE/sjkJ8ML2BYmuRcjhRl/q5kVDXG7W9LOOKwzPU5M0LBlXRq9rlSgnNlg==",
+      "version": "1.4.200",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.200.tgz",
+      "integrity": "sha512-nPyI7oHc8T64oSqRXrAt99gNMpk0SAgPHw/o+hkNKyb5+bcdnFtZcSO9FUJES5cVkVZvo8u4qiZ1gQILl8UXsA==",
       "dev": true
     },
     "node_modules/emittery": {
@@ -2116,6 +2129,14 @@
         "node": ">= 0.10.0"
       }
     },
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
+      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -6187,9 +6208,9 @@
       "integrity": "sha512-iiUgKzV9AuaEkZqkOLDIvlQiL6ltuZd9tGcW3gwpnX8JbuiuhFlEGmmFXEXkN50Cvq7Os88IY2v0dkDqXYWVgA=="
     },
     "@types/node": {
-      "version": "18.0.6",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.0.6.tgz",
-      "integrity": "sha512-/xUq6H2aQm261exT6iZTMifUySEt4GR5KX8eYyY+C4MSNPqSh9oNIP7tz2GLKTlFaiBbgZNxffoR3CVRG+cljw=="
+      "version": "18.6.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.6.1.tgz",
+      "integrity": "sha512-z+2vB6yDt1fNwKOeGbckpmirO+VBDuQqecXkgeIqDlaOtmKn6hPR/viQ8cxCfqLU4fTlvM3+YjM367TukWdxpg=="
     },
     "@types/prettier": {
       "version": "2.6.3",
@@ -6545,9 +6566,9 @@
       "dev": true
     },
     "caniuse-lite": {
-      "version": "1.0.30001369",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001369.tgz",
-      "integrity": "sha512-OY1SBHaodJc4wflDIKnlkdqWzJZd1Ls/2zbVJHBSv3AT7vgOJ58yAhd2CN4d57l2kPJrgMb7P9+N1Mhy4tNSQA==",
+      "version": "1.0.30001370",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001370.tgz",
+      "integrity": "sha512-3PDmaP56wz/qz7G508xzjx8C+MC2qEm4SYhSEzC9IBROo+dGXFWRuaXkWti0A9tuI00g+toiriVqxtWMgl350g==",
       "dev": true
     },
     "chalk": {
@@ -6678,9 +6699,18 @@
       }
     },
     "cookie": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
-      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw=="
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz",
+      "integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA=="
+    },
+    "cookie-parser": {
+      "version": "1.4.6",
+      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz",
+      "integrity": "sha512-z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==",
+      "requires": {
+        "cookie": "0.4.1",
+        "cookie-signature": "1.0.6"
+      }
     },
     "cookie-signature": {
       "version": "1.0.6",
@@ -6847,9 +6877,9 @@
       "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="
     },
     "electron-to-chromium": {
-      "version": "1.4.199",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.199.tgz",
-      "integrity": "sha512-WIGME0Cs7oob3mxsJwHbeWkH0tYkIE/sjkJ8ML2BYmuRcjhRl/q5kVDXG7W9LOOKwzPU5M0LBlXRq9rlSgnNlg==",
+      "version": "1.4.200",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.200.tgz",
+      "integrity": "sha512-nPyI7oHc8T64oSqRXrAt99gNMpk0SAgPHw/o+hkNKyb5+bcdnFtZcSO9FUJES5cVkVZvo8u4qiZ1gQILl8UXsA==",
       "dev": true
     },
     "emittery": {
@@ -7002,6 +7032,13 @@
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
+      },
+      "dependencies": {
+        "cookie": {
+          "version": "0.5.0",
+          "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
+          "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw=="
+        }
       }
     },
     "fast-json-stable-stringify": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.4.14",
+  "version": "1.6.1",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
@@ -21,6 +21,7 @@
   "homepage": "https://github.com/krgamestudios/auth-server#readme",
   "dependencies": {
     "bcryptjs": "^2.4.3",
+    "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "dotenv": "^8.6.0",
     "express": "^4.17.1",

server/admin/default-account.js

@@ -25,7 +25,7 @@ module.exports = async () => {
 	});
 
 	if (adminRecord == null) {
-		const webAddress = process.env.WEB_ADDRESS == 'localhost' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
+		const webAddress = process.env.WEB_ADDRESS == 'localhost:3000' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
 		await accounts.create({
 			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
 			username: `${process.env.ADMIN_DEFAULT_USERNAME}`,

server/auth/login.js

@@ -3,7 +3,7 @@ const utils = require('util');
 const bcrypt = require('bcryptjs');
 
 const { accounts } = require('../database/models');
-const tokenGenerate = require('../utilities/token-generate');
+const tokenGenerateRefresh = require('../utilities/token-generate-refresh');
 
 //utilities
 const validateEmail = require('../utilities/validate-email');
@@ -49,10 +49,13 @@ const route = async (req, res) => {
 	}
 
 	//generate the JWTs
-	const tokens = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
+	const { accessToken, refreshToken } = tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
+
+	//set the cookie
+	res.cookie('refreshToken', refreshToken, { path: '/', httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 * 1000 }); //30 days
 
 	//finally
-	res.status(200).json(tokens);
+	res.status(200).send(accessToken);
 	return null;
 };
 

server/auth/logout.js

@@ -2,7 +2,10 @@ const tokenDestroy = require('../utilities/token-destroy');
 
 //auth/logout
 const route = (req, res) => {
-	tokenDestroy(req.body.token);
+	//stored in the cookie
+	tokenDestroy(req.cookies.refreshToken);
+
+	res.clearCookie('refreshToken');
 
 	return res.status(200).end();
 };

server/auth/token.js

@@ -4,13 +4,14 @@ const tokenRefresh = require('../utilities/token-refresh');
 
 //auth/token
 module.exports = async (req, res) => {
-	const refreshToken = req.body.token;
-
-	return tokenRefresh(refreshToken, (err, token) => {
+	return tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
 		if (err) {
 			return res.status(err).end();
 		}
 
-		return res.status(200).send(token);
+		//set the cookie
+		res.cookie('refreshToken', refreshToken, { path: '/', httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 * 1000 }); //30 days
+
+		return res.status(200).send({ accessToken });
 	});
 };

server/auth/validation.js

@@ -64,13 +64,13 @@ const route = async (req, res) => {
 				});
 
 				if (!probe.ok) {
-					throw `Could not probe the post validation hook: ${hook}`;
+					throw `Could not probe the post validation hook: ${hook} with accountIndex = ${account.index}`;
 				}
 
 				//discard the result
 			});
 
-			Promise.all(promises);
+			await Promise.all(promises);
 		}
 		catch(e) {
 			console.error('HOOK_POST_VALIDATION_ARRAY is not a valid array of strings in JSON format: ' + e);

server/server.js

@@ -6,10 +6,19 @@ const express = require('express');
 const app = express();
 const server = require('http').Server(app);
 const cors = require('cors');
+const cookieParser = require('cookie-parser');
 
 //config
 app.use(express.json());
-app.use(cors());
+
+app.use(cors({
+	credentials: true,
+	origin: [`${process.env.WEB_PROTOCOL}://${process.env.WEB_ORIGIN}`],
+	allowedHeaders: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'Authorization', 'Set-Cookie'],
+	exposedHeaders: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'Authorization', 'Set-Cookie'],
+}));
+
+app.use(cookieParser());
 
 //database connection
 const database = require('./database');

server/utilities/token-auth.js

@@ -3,13 +3,13 @@ const jwt = require('jsonwebtoken');
 //middleware to authenticate the JWT token
 module.exports = (req, res, next) => {
 	const authHeader = req.headers['authorization'];
-	const token = authHeader?.split(' ')[1]; //'Bearer token'
+	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
 
-	if (!token) {
-		return res.status(401).send('No token found');
+	if (!accessToken) {
+		return res.status(401).send('No access token found');
 	}
 
-	return jwt.verify(token, process.env.SECRET_ACCESS, (err, user) => {
+	return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {
 		if (err) {
 			return res.status(403).send(err);
 		}

server/utilities/token-destroy.js

@@ -1,9 +1,9 @@
 const { tokens } = require('../database/models');
 
-module.exports = (token) => {
+module.exports = (refreshToken) => {
 	tokens.destroy({
 		where: {
-			token: token || ''
+			token: refreshToken || ''
 		}
 	});
 }

server/utilities/token-refresh.js

@@ -1,17 +1,17 @@
 const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
-const generate = require('./token-generate');
+const generate = require('./token-generate-refresh');
 const destroy = require('./token-destroy');
 
-module.exports = async (token, callback) => {
-	if (!token) {
+module.exports = async (oldRefreshToken, callback) => {
+	if (!oldRefreshToken) {
 		return callback(401);
 	}
 
 	const tokenRecord = await tokens.findOne({
 		where: {
-			token: token || ''
+			token: oldRefreshToken || ''
 		}
 	});
 
@@ -19,15 +19,15 @@ module.exports = async (token, callback) => {
 		return callback(403);
 	}
 
-	jwt.verify(token, process.env.SECRET_REFRESH, (err, user) => {
+	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, (err, user) => {
 		if (err) {
 			return callback(403);
 		}
 
-		const result = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
+		const { accessToken, refreshToken } = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
-		destroy(token);
+		destroy(oldRefreshToken);
 
-		return callback(null, result);
+		return callback(null, accessToken, refreshToken);
 	});
 };

tools/react/README.md

@@ -47,7 +47,7 @@ export default Component;
 The most useful features provided by TokenProvider are:
 
 * `tokenFetch()`, which wraps the `fetch()` API to ensure that your access token is valid
-* `tokenCallback()`, which passes the authTokens as a parameter to any function passed into it
+* `tokenCallback()`, which passes the accessToken as a parameter to any function passed into it
 * `getPayload()`, which returns the payload of the accessToken (including as "email", "username", "admin", and "mod")
 * `accessToken`, this will be falsy if the user is not logged in
 

tools/react/token-provider.jsx

@@ -8,19 +8,16 @@ export const TokenContext = createContext();
 const TokenProvider = props => {
 	//state to be used
 	const [accessToken, setAccessToken] = useState('');
-	const [refreshToken, setRefreshToken] = useState('');
 
-	//make the access and refresh tokens persist between reloads
+	//make the access token persist between reloads
 	useEffect(() => {
 		setAccessToken(localStorage.getItem("accessToken") || '');
-		setRefreshToken(localStorage.getItem("refreshToken") || '');
 	}, []);
 
 	//update the stored copies
 	useEffect(() => {
 		localStorage.setItem("accessToken", accessToken);
-		localStorage.setItem("refreshToken", refreshToken);
-	}, [accessToken, refreshToken]);
+	}, [accessToken]);
 
 	//wrap the default fetch function
 	const tokenFetch = async (url, options) => {
@@ -36,24 +33,16 @@ const TokenProvider = props => {
 				return fetch(url, {
 					method: 'DELETE',
 					headers: {
-						'Content-Type': 'application/json',
 						'Authorization': `Bearer ${bearer}`
 					},
-					body: JSON.stringify({
-						token: refreshToken
-					})
+					credentials: 'include'
 				});
 			}
 
-			//ping the auth server for a new token
+			//ping the auth server for a new access token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
-				headers: {
-					'Content-Type': 'application/json'
-				},
-				body: JSON.stringify({
-					token: refreshToken
-				})
+				credentials: 'include'
 			});
 
 			//any errors, throw them
@@ -65,7 +54,6 @@ const TokenProvider = props => {
 			const newAuth = await response.json();
 
 			setAccessToken(newAuth.accessToken);
-			setRefreshToken(newAuth.refreshToken);
 			bearer = newAuth.accessToken;
 		}
 
@@ -75,7 +63,8 @@ const TokenProvider = props => {
 			headers: {
 				...(options || { headers: {} }).headers,
 				'Authorization': `Bearer ${bearer}`
-			}
+			},
+			credentials: 'include'
 		});
 	};
 
@@ -88,12 +77,7 @@ const TokenProvider = props => {
 			//ping the auth server for a new token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
-				headers: {
-					'Content-Type': 'application/json'
-				},
-				body: JSON.stringify({
-					token: refreshToken
-				})
+				credentials: 'include'
 			});
 
 			//any errors, throw them
@@ -105,7 +89,6 @@ const TokenProvider = props => {
 			const newAuth = await response.json();
 
 			setAccessToken(newAuth.accessToken);
-			setRefreshToken(newAuth.refreshToken);
 
 			//finally
 			return cb(newAuth.accessToken);
@@ -115,7 +98,7 @@ const TokenProvider = props => {
 	};
 
 	return (
-		<TokenContext.Provider value={{ accessToken, refreshToken, setAccessToken, setRefreshToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
+		<TokenContext.Provider value={{ accessToken, setAccessToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
 			{props.children}
 		</TokenContext.Provider>
 	)