Skip to content

Commit 680021e

Browse files
suboticsubotic
authored
fix(authentication): make cookie name unique between environments (#2091)
1 parent 94d2b46 commit 680021e

9 files changed

Lines changed: 445 additions & 174 deletions

File tree

‎sipi/scripts/basexx.lua‎

Lines changed: 298 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,298 @@
1+
--------------------------------------------------------------------------------
2+
-- https://github.com/aiq/basexx/releases/tag/v0.4.1
3+
-- util functions
4+
--------------------------------------------------------------------------------
5+
6+
local function divide_string( str, max )
7+
local result = {}
8+
9+
local start = 1
10+
for i = 1, #str do
11+
if i % max == 0 then
12+
table.insert( result, str:sub( start, i ) )
13+
start = i + 1
14+
elseif i == #str then
15+
table.insert( result, str:sub( start, i ) )
16+
end
17+
end
18+
19+
return result
20+
end
21+
22+
local function number_to_bit( num, length )
23+
local bits = {}
24+
25+
while num > 0 do
26+
local rest = math.floor( math.fmod( num, 2 ) )
27+
table.insert( bits, rest )
28+
num = ( num - rest ) / 2
29+
end
30+
31+
while #bits < length do
32+
table.insert( bits, "0" )
33+
end
34+
35+
return string.reverse( table.concat( bits ) )
36+
end
37+
38+
local function ignore_set( str, set )
39+
if set then
40+
str = str:gsub( "["..set.."]", "" )
41+
end
42+
return str
43+
end
44+
45+
local function pure_from_bit( str )
46+
return ( str:gsub( '........', function ( cc )
47+
return string.char( tonumber( cc, 2 ) )
48+
end ) )
49+
end
50+
51+
local function unexpected_char_error( str, pos )
52+
local c = string.sub( str, pos, pos )
53+
return string.format( "unexpected character at position %d: '%s'", pos, c )
54+
end
55+
56+
--------------------------------------------------------------------------------
57+
58+
local basexx = {}
59+
60+
--------------------------------------------------------------------------------
61+
-- base2(bitfield) decode and encode function
62+
--------------------------------------------------------------------------------
63+
64+
local bitMap = { o = "0", i = "1", l = "1" }
65+
66+
function basexx.from_bit( str, ignore )
67+
str = ignore_set( str, ignore )
68+
str = string.lower( str )
69+
str = str:gsub( '[ilo]', function( c ) return bitMap[ c ] end )
70+
local pos = string.find( str, "[^01]" )
71+
if pos then return nil, unexpected_char_error( str, pos ) end
72+
73+
return pure_from_bit( str )
74+
end
75+
76+
function basexx.to_bit( str )
77+
return ( str:gsub( '.', function ( c )
78+
local byte = string.byte( c )
79+
local bits = {}
80+
for _ = 1,8 do
81+
table.insert( bits, byte % 2 )
82+
byte = math.floor( byte / 2 )
83+
end
84+
return table.concat( bits ):reverse()
85+
end ) )
86+
end
87+
88+
--------------------------------------------------------------------------------
89+
-- base16(hex) decode and encode function
90+
--------------------------------------------------------------------------------
91+
92+
function basexx.from_hex( str, ignore )
93+
str = ignore_set( str, ignore )
94+
local pos = string.find( str, "[^%x]" )
95+
if pos then return nil, unexpected_char_error( str, pos ) end
96+
97+
return ( str:gsub( '..', function ( cc )
98+
return string.char( tonumber( cc, 16 ) )
99+
end ) )
100+
end
101+
102+
function basexx.to_hex( str )
103+
return ( str:gsub( '.', function ( c )
104+
return string.format('%02X', string.byte( c ) )
105+
end ) )
106+
end
107+
108+
--------------------------------------------------------------------------------
109+
-- generic function to decode and encode base32/base64
110+
--------------------------------------------------------------------------------
111+
112+
local function from_basexx( str, alphabet, bits )
113+
local result = {}
114+
for i = 1, #str do
115+
local c = string.sub( str, i, i )
116+
if c ~= '=' then
117+
local index = string.find( alphabet, c, 1, true )
118+
if not index then
119+
return nil, unexpected_char_error( str, i )
120+
end
121+
table.insert( result, number_to_bit( index - 1, bits ) )
122+
end
123+
end
124+
125+
local value = table.concat( result )
126+
local pad = #value % 8
127+
return pure_from_bit( string.sub( value, 1, #value - pad ) )
128+
end
129+
130+
local function to_basexx( str, alphabet, bits, pad )
131+
local bitString = basexx.to_bit( str )
132+
133+
local chunks = divide_string( bitString, bits )
134+
local result = {}
135+
for _,value in ipairs( chunks ) do
136+
if ( #value < bits ) then
137+
value = value .. string.rep( '0', bits - #value )
138+
end
139+
local pos = tonumber( value, 2 ) + 1
140+
table.insert( result, alphabet:sub( pos, pos ) )
141+
end
142+
143+
table.insert( result, pad )
144+
return table.concat( result )
145+
end
146+
147+
--------------------------------------------------------------------------------
148+
-- rfc 3548: http://www.rfc-editor.org/rfc/rfc3548.txt
149+
--------------------------------------------------------------------------------
150+
151+
local base32Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
152+
local base32PadMap = { "", "======", "====", "===", "=" }
153+
154+
function basexx.from_base32( str, ignore )
155+
str = ignore_set( str, ignore )
156+
return from_basexx( string.upper( str ), base32Alphabet, 5 )
157+
end
158+
159+
function basexx.to_base32( str )
160+
return to_basexx( str, base32Alphabet, 5, base32PadMap[ #str % 5 + 1 ] )
161+
end
162+
163+
--------------------------------------------------------------------------------
164+
-- crockford: http://www.crockford.com/wrmg/base32.html
165+
--------------------------------------------------------------------------------
166+
167+
local crockfordAlphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"
168+
local crockfordMap = { O = "0", I = "1", L = "1" }
169+
170+
function basexx.from_crockford( str, ignore )
171+
str = ignore_set( str, ignore )
172+
str = string.upper( str )
173+
str = str:gsub( '[ILOU]', function( c ) return crockfordMap[ c ] end )
174+
return from_basexx( str, crockfordAlphabet, 5 )
175+
end
176+
177+
function basexx.to_crockford( str )
178+
return to_basexx( str, crockfordAlphabet, 5, "" )
179+
end
180+
181+
--------------------------------------------------------------------------------
182+
-- base64 decode and encode function
183+
--------------------------------------------------------------------------------
184+
185+
local base64Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"..
186+
"abcdefghijklmnopqrstuvwxyz"..
187+
"0123456789+/"
188+
local base64PadMap = { "", "==", "=" }
189+
190+
function basexx.from_base64( str, ignore )
191+
str = ignore_set( str, ignore )
192+
return from_basexx( str, base64Alphabet, 6 )
193+
end
194+
195+
function basexx.to_base64( str )
196+
return to_basexx( str, base64Alphabet, 6, base64PadMap[ #str % 3 + 1 ] )
197+
end
198+
199+
--------------------------------------------------------------------------------
200+
-- URL safe base64 decode and encode function
201+
--------------------------------------------------------------------------------
202+
203+
local url64Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"..
204+
"abcdefghijklmnopqrstuvwxyz"..
205+
"0123456789-_"
206+
207+
function basexx.from_url64( str, ignore )
208+
str = ignore_set( str, ignore )
209+
return from_basexx( str, url64Alphabet, 6 )
210+
end
211+
212+
function basexx.to_url64( str )
213+
return to_basexx( str, url64Alphabet, 6, "" )
214+
end
215+
216+
--------------------------------------------------------------------------------
217+
--
218+
--------------------------------------------------------------------------------
219+
220+
local function length_error( len, d )
221+
return string.format( "invalid length: %d - must be a multiple of %d", len, d )
222+
end
223+
224+
local z85Decoder = { 0x00, 0x44, 0x00, 0x54, 0x53, 0x52, 0x48, 0x00,
225+
0x4B, 0x4C, 0x46, 0x41, 0x00, 0x3F, 0x3E, 0x45,
226+
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
227+
0x08, 0x09, 0x40, 0x00, 0x49, 0x42, 0x4A, 0x47,
228+
0x51, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A,
229+
0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32,
230+
0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A,
231+
0x3B, 0x3C, 0x3D, 0x4D, 0x00, 0x4E, 0x43, 0x00,
232+
0x00, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10,
233+
0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
234+
0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20,
235+
0x21, 0x22, 0x23, 0x4F, 0x00, 0x50, 0x00, 0x00 }
236+
237+
function basexx.from_z85( str, ignore )
238+
str = ignore_set( str, ignore )
239+
if ( #str % 5 ) ~= 0 then
240+
return nil, length_error( #str, 5 )
241+
end
242+
243+
local result = {}
244+
245+
local value = 0
246+
for i = 1, #str do
247+
local index = string.byte( str, i ) - 31
248+
if index < 1 or index >= #z85Decoder then
249+
return nil, unexpected_char_error( str, i )
250+
end
251+
value = ( value * 85 ) + z85Decoder[ index ]
252+
if ( i % 5 ) == 0 then
253+
local divisor = 256 * 256 * 256
254+
while divisor ~= 0 do
255+
local b = math.floor( value / divisor ) % 256
256+
table.insert( result, string.char( b ) )
257+
divisor = math.floor( divisor / 256 )
258+
end
259+
value = 0
260+
end
261+
end
262+
263+
return table.concat( result )
264+
end
265+
266+
local z85Encoder = "0123456789"..
267+
"abcdefghijklmnopqrstuvwxyz"..
268+
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"..
269+
".-:+=^!/*?&<>()[]{}@%$#"
270+
271+
function basexx.to_z85( str )
272+
if ( #str % 4 ) ~= 0 then
273+
return nil, length_error( #str, 4 )
274+
end
275+
276+
local result = {}
277+
278+
local value = 0
279+
for i = 1, #str do
280+
local b = string.byte( str, i )
281+
value = ( value * 256 ) + b
282+
if ( i % 4 ) == 0 then
283+
local divisor = 85 * 85 * 85 * 85
284+
while divisor ~= 0 do
285+
local index = ( math.floor( value / divisor ) % 85 ) + 1
286+
table.insert( result, z85Encoder:sub( index, index ) )
287+
divisor = math.floor( divisor / 85 )
288+
end
289+
value = 0
290+
end
291+
end
292+
293+
return table.concat( result )
294+
end
295+
296+
--------------------------------------------------------------------------------
297+
298+
return basexx

‎sipi/scripts/get_knora_session.lua‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
-- * Copyright © 2021 - 2022 Swiss National Data and Service Center for the Humanities and/or DaSCH Service Platform contributors.
22
-- * SPDX-License-Identifier: Apache-2.0
33

4+
basexx = require( "basexx" )
5+
46
-------------------------------------------------------------------------------
57
-- This function is called from the route to get the Knora session id from the cookie.
68
-- The cookie is sent to Sipi by the client (HTTP request header).
@@ -17,13 +19,37 @@ function get_session_id(cookie)
1719
return nil
1820
end
1921

22+
-- name of the cokie depends on the environment defined as host:port combination
23+
-- this combination is "mangled" using base32 and appended to "KnoraAuthentication"
24+
-- to get the correct cokie, we need to calculate first the mangled host-port combination
25+
local webapi_hostname = os.getenv("KNORA_WEBAPI_KNORA_API_EXTERNAL_HOST")
26+
local webapi_port = os.getenv("KNORA_WEBAPI_KNORA_API_EXTERNAL_PORT")
27+
if webapi_hostname == nil then
28+
send_error(500, "KNORA_WEBAPI_KNORA_API_EXTERNAL_HOST not set")
29+
return nil
30+
end
31+
if webapi_port == nil then
32+
send_error(500, "KNORA_WEBAPI_KNORA_API_EXTERNAL_PORT not set")
33+
return nil
34+
end
35+
36+
host_port = webapi_hostname .. ':' .. webapi_port
37+
server.log("host_port: " .. host_port, server.loglevel.LOG_DEBUG)
38+
39+
local customPadMap = { "", "999999", "9999", "999", "9" }
40+
host_port_base32 = basexx.to_basexx(host_port, base32Alphabet, 5, customPadMap)
41+
server.log("host_port_base32: " .. host_port_base32, server.loglevel.LOG_DEBUG)
42+
43+
44+
2045
-- tries to extract the Knora session id from the cookie:
2146
-- gets the digits between "sid=" and the closing ";" (only given in case of several key value pairs)
2247
-- ";" is expected to separate different key value pairs (https://tools.ietf.org/html/rfc6265#section-4.2.1)
2348
-- space is also treated as a separator
2449
-- returns nil if it cannot find the session id (pattern does not match)
2550
server.log("extracted cookie: " .. cookie, server.loglevel.LOG_DEBUG)
26-
local session_id = string.match(cookie, "KnoraAuthentication=([^%s;]+)")
51+
local session_id = string.match(cookie, "KnoraAuthentication" .. host_port_base32 .. "=([^%s;]+)")
52+
server.log("extracted session_id: " .. session_id, server.loglevel.LOG_DEBUG)
2753

2854
return session_id
2955

‎webapi/src/main/resources/application.conf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -283,8 +283,6 @@ app {
283283

284284
show-internal-errors = true // If true, clients will see error messages from internal errors. Useful for debugging. If false, those error messages will appear only in the log.
285285

286-
skip-authentication = false // If true, the authentication process is skiped and the Lothar Schmidt user is returned by default.
287-
288286
bcrypt-password-strength = 12 // Value range is 10-32.
289287
bcrypt-password-strength = ${?KNORA_WEBAPI_BCRYPT_PASSWORD_STRENGTH}
290288

‎webapi/src/main/scala/org/knora/webapi/config/AppConfig.scala‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ final case class AppConfig(
1919
defaultTimeout: String,
2020
dumpMessages: Boolean,
2121
showInternalErrors: Boolean,
22-
skipAuthentication: Boolean,
2322
bcryptPasswordStrength: Int,
2423
jwtSecretKey: String,
2524
jwtLongevity: String,

0 commit comments

Comments
 (0)