Login Token Questions

[amit-vn]

Thank you for providing us such a great application. Really appreciated. Great work.

I am trying to embed the Mesh Central in my other web application, so that user doesn't have to login twice. Each user can control specific agents.
However, the problem is that login token is valid for 1 hour and user can copy the URL from iframe and use it outside the application. From security perspective, if the users are sharing the machine, one user can use other persons URL.

As a feature request, could you please change the behavior to expire the login token after 1 time use?

Also could you please explain more how we can use the login token key on business server to generate the login token for specific user.

Thanks in advance for your reply.

[Ylianst]

I get it, yes, this is a good idea and I will do this. I will add an attribute in the token for single use so that a token can be used both for time limited or single use. I have to figure out where I keep server state on cookies I have already seen. is it ok if the cookies are 1 hour & single use? That way, I can ditch the server state on seen cookies after one hour.

[amit-vn]

Yes. That would be perfect.

Thanks you

[Ylianst]

Published MeshCentral v0.4.5-r with a partial implementation for this. When you generate your cookie, add "once":"uniquestring" in the cookie. If "once" is present in the cookie, the server will not allow the same string value to be used again until 3 minutes after the cookie expire time.

So, you should generate your cookies with a counter or some long random. Make sure the value of "once" is a string, so if you have a counter, convert it to a string.

This implementation is partial because the "Already Used" cookie table is only in memory, so if you restart the server, it will accept the cookie only once again. I also recommend you put "expire" in the cookie and set a short timeout if possible. This way, the "Already used" cookie table will not grow very large as cookies timeout expires quickly.

Hope this helps, feedback appreciated.

[amit-vn]

Thank you so much for fixing it quickly.
That worked well.
Really appreciated your hard work and again thanks for this great product.

[Ylianst]

Excellent. Are you generating your own cookies or asking MeshCentral to create them? I am thinking that if I added a unique identifier that changes on every MeshCentral server start, I would not need to store used cookies in the database.

[amit-vn]

I am generating my own cookie.

[adsgreen]

Theres a couple extensions to the cookie that would be useful:

• embed the "viewmode" and "hide" parameters. current implementation a user can change them and break out of the controlled view.
• option to add the remote ip address to lock the cookie to a specific ip.

Not essentials and definitely "nice to haves".

[Ylianst]

Hi. Good suggestions. For the public IP check, I don't think it's a nice to have :) It's already present unless you set `CookieIpCheck: false' in the setting section of config.json, the IP address will be checked if present in the cookie.

For the viewmode/hide, having that in the cookie would not prevent an advanced user from breaking out, but the point is taken that it would be nice to encode limited rights to a specific device within the cookie.

[darryl-h]

Hi guys,

I was going to file a feature request for a one time URL, but I think that this is almost the same thing (Please let me know if you would like me to file a new request!)
Our use case is similar, but somewhat different.

We will use the following code example to generate a URL, we will then embed that URL in our main site through an i-frame behind our existing authentication, the one time URL token seems to work as expected, however, we restart the server regularly to re-read the config.json. Additionally since the MeshCentral service needs to be restarted based on the new recovery instructions for MeshCentral, this makes restarting more common. Consequently this makes it somewhat less desirable to have this only in memory thereby allowing the URL token to be re-used.

I won't pretend to understand crypto, so I've re-used some code from margo-vogt in report #59, and used time as the 'unique string'

import time
import hashlib
import secrets
import base64
from Crypto.Cipher import AES
from binascii import unhexlify
 
def encode(key,user,action=3):
    key         = bytes.fromhex(key)
    key1        = key[0:48]
    key2        = key[48:]
    # msg         = '{{"a":{}, "u":"{}","time":{}}}'.format(action, user, int(time.time()))
    msg         = '{{"a":{}, "u":"{}", "once":"{}", "time":{}}}'.format(action, user, int(time.time()), int(time.time()))
    iv          = secrets.token_bytes(16)
 
    #sha
    h= hashlib.sha3_384()
    h.update(key1)
    msg= h.digest() + msg.encode()
 
    #aes
    a   = AES.new(key2, AES.MODE_CBC, iv)
    n   = 16-(len(msg)%16)
    n   = 16 if n==0 else n
    pad = unhexlify('%02x' % n)
    msg = a.encrypt(msg + pad*n)
 
    return base64.b64encode(iv+msg, altchars=b"@$").decode("utf-8")

Ask

1. Is there anything inherently wrong with using the time as a the 'unique string' ?
2. Assuming this can be 'worked around' by setting an expire time in a cookie, can you point me to an example of this? I understand how to expire a cookie, but I don't get how one would embed the URL in the cookie so that someone wasn't able to expose the URL and re-use that when the server restarted.

As always, thanks for your time and dedication on this amazing product!