fix(auth): harden async login boundaries

This commit is contained in:
2026-08-17 00:00:34 +02:00
parent 29bfb41363
commit c34e01e9b9
8 changed files with 426 additions and 124 deletions
+21 -54
View File
@@ -1,60 +1,17 @@
import { afterEach, expect, test } from "vitest";
import { chmodSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { stringify } from "yaml";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";
import { deriveCsrfToken } from "../src/auth/csrf.js";
import { createLocalAuthFixture, localPublicUrl } from "./auth-test-fixtures.js";
const password = "correct horse battery staple";
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
const adminId = "6ba7b810-9dad-4ed1-80b4-00c04fd430c8";
const publicUrl = "http://127.0.0.1:8787";
const cleanups: Array<() => Promise<void>> = [];
afterEach(async () => {
for (const cleanup of cleanups.splice(0).reverse()) await cleanup();
});
function sessionCookie(response: { headers: Record<string, string | string[] | undefined> }): string {
const setCookie = response.headers["set-cookie"];
const first = Array.isArray(setCookie) ? setCookie[0] : setCookie;
return first?.split(";", 1)[0] ?? "";
}
async function createApp() {
const directory = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-csrf-"));
chmodSync(directory, 0o700);
const authConfigFile = join(directory, "auth.yaml");
const usersFile = join(directory, "users.yaml");
writeFileSync(authConfigFile, stringify({
version: 1, mode: "local", publicUrl, local: { usersFile: "users.yaml" },
}), { encoding: "utf8", mode: 0o600 });
writeFileSync(usersFile, [
"version: 1", "users:", ` - id: ${adminId}`, " username: Admin",
" displayName: Local administrator", ` passwordHash: ${passwordHash}`,
" roles:", " - admin", " enabled: true", " authRevision: 1", "",
].join("\n"), { encoding: "utf8", mode: 0o600 });
chmodSync(authConfigFile, 0o600);
chmodSync(usersFile, 0o600);
const app = buildApp(loadConfig({
THT_AUTH_CONFIG_FILE: authConfigFile,
THT_AUTH_STATE_ROOT: join(directory, "auth-state"),
THT_HARNESS_DIR: "/tmp/h",
}));
cleanups.push(async () => {
await app.close();
rmSync(directory, { recursive: true, force: true });
});
const signedIn = await app.inject({
method: "POST", url: "/auth/local/login",
headers: { origin: publicUrl, "sec-fetch-site": "same-origin" },
payload: { username: "Admin", password },
});
const cookie = sessionCookie(signedIn);
const me = await app.inject({ method: "GET", url: "/me", headers: { cookie } });
return { app, cookie, csrfToken: me.json().csrfToken as string };
const fixture = await createLocalAuthFixture();
cleanups.push(() => fixture.close());
return fixture;
}
test("derived CSRF tokens are deterministic per opaque cookie and are never the cookie token", async () => {
@@ -68,10 +25,10 @@ test("derived CSRF tokens are deterministic per opaque cookie and are never the
test("cookie-authenticated state changes require an exact Origin, Fetch Metadata when present, and CSRF token", async () => {
const { app, cookie, csrfToken } = await createApp();
const cases = [
{ headers: { cookie, origin: publicUrl, "sec-fetch-site": "same-origin" } },
{ headers: { cookie, origin: localPublicUrl, "sec-fetch-site": "same-origin" } },
{ headers: { cookie, origin: "http://127.0.0.1:8788", "sec-fetch-site": "same-origin", "x-thothii-csrf": csrfToken } },
{ headers: { cookie, origin: publicUrl, "sec-fetch-site": "cross-site", "x-thothii-csrf": csrfToken } },
{ headers: { cookie, origin: publicUrl, "x-thothii-csrf": csrfToken.slice(0, -1) } },
{ headers: { cookie, origin: localPublicUrl, "sec-fetch-site": "cross-site", "x-thothii-csrf": csrfToken } },
{ headers: { cookie, origin: localPublicUrl, "x-thothii-csrf": csrfToken.slice(0, -1) } },
];
for (const request of cases) {
@@ -85,26 +42,36 @@ test("duplicate or malformed CSRF and session-cookie headers fail closed", async
const { app, cookie, csrfToken } = await createApp();
const duplicateCsrf = await app.inject({
method: "POST", url: "/auth/logout",
headers: { cookie, origin: publicUrl, "x-thothii-csrf": `${csrfToken}, ${csrfToken}` },
headers: { cookie, origin: localPublicUrl, "x-thothii-csrf": `${csrfToken}, ${csrfToken}` },
});
const duplicateCookie = await app.inject({
method: "POST", url: "/auth/logout",
headers: { cookie: `${cookie}; ${cookie}`, origin: publicUrl, "x-thothii-csrf": csrfToken },
headers: { cookie: `${cookie}; ${cookie}`, origin: localPublicUrl, "x-thothii-csrf": csrfToken },
});
const malformedCookie = await app.inject({
method: "POST", url: "/auth/logout",
headers: { cookie: "thothii_session=not-a-token", origin: publicUrl, "x-thothii-csrf": csrfToken },
headers: { cookie: "thothii_session=not-a-token", origin: localPublicUrl, "x-thothii-csrf": csrfToken },
});
const oversizedCsrf = await app.inject({
method: "POST", url: "/auth/logout",
headers: { cookie, origin: localPublicUrl, "x-thothii-csrf": "x".repeat(4097) },
});
const oversizedCookie = await app.inject({
method: "POST", url: "/auth/logout",
headers: { cookie: `${cookie}; padding=${"x".repeat(4097)}`, origin: localPublicUrl, "x-thothii-csrf": csrfToken },
});
expect(duplicateCsrf.statusCode).toBe(403);
expect(duplicateCookie.statusCode).toBe(401);
expect(malformedCookie.statusCode).toBe(401);
expect(oversizedCsrf.statusCode).toBe(403);
expect(oversizedCookie.statusCode).toBe(401);
});
test("an unauthenticated state-changing application route cannot bypass the central boundary", async () => {
const { app } = await createApp();
const response = await app.inject({
method: "POST", url: "/sessions", headers: { origin: publicUrl, "x-thothii-csrf": "x".repeat(43) },
method: "POST", url: "/sessions", headers: { origin: localPublicUrl, "x-thothii-csrf": "x".repeat(43) },
payload: { question: "must not reach a session handler" },
});
expect(response.statusCode).toBe(401);
+19 -19
View File
@@ -2,11 +2,11 @@ import { readFileSync } from "node:fs";
import { resolve } from "node:path";
import { describe, expect, test, vi } from "vitest";
const { argon2SyncSpy } = vi.hoisted(() => ({ argon2SyncSpy: vi.fn() }));
const { argon2Spy } = vi.hoisted(() => ({ argon2Spy: vi.fn() }));
vi.mock("node:crypto", async (importOriginal) => {
const actual = await importOriginal<typeof import("node:crypto")>();
argon2SyncSpy.mockImplementation(actual.argon2Sync);
return { ...actual, argon2Sync: argon2SyncSpy };
argon2Spy.mockImplementation(actual.argon2);
return { ...actual, argon2: argon2Spy };
});
import { verifyPassword } from "../src/auth/password.js";
@@ -22,51 +22,51 @@ const vectors = JSON.parse(readFileSync(
)) as Argon2Vector[];
describe("local Argon2id password verification", () => {
test("accepts every committed Go-generated vector", () => {
test("accepts every committed Go-generated vector", async () => {
expect(vectors.length).toBeGreaterThan(0);
for (const vector of vectors) {
expect(verifyPassword(vector.password, vector.phc)).toBe(true);
await expect(verifyPassword(vector.password, vector.phc)).resolves.toBe(true);
}
});
test("rejects a one-byte password change", () => {
test("rejects a one-byte password change", async () => {
for (const vector of vectors) {
expect(verifyPassword(`${vector.password}!`, vector.phc)).toBe(false);
await expect(verifyPassword(`${vector.password}!`, vector.phc)).resolves.toBe(false);
}
});
test("rejects ill-formed Unicode instead of authenticating as U+FFFD", () => {
test("rejects ill-formed Unicode instead of authenticating as U+FFFD", async () => {
const replacementPassword = "correct horse battery stap\uFFFD";
const loneSurrogatePassword = "correct horse battery stap\uD800";
const replacementPasswordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$+tAXzgaQVnNaonNvgevyG6UKlaKcwyRMi1mESNk0BvQ";
expect(verifyPassword(replacementPassword, replacementPasswordHash)).toBe(true);
expect(verifyPassword(loneSurrogatePassword, replacementPasswordHash)).toBe(false);
await expect(verifyPassword(replacementPassword, replacementPasswordHash)).resolves.toBe(true);
await expect(verifyPassword(loneSurrogatePassword, replacementPasswordHash)).resolves.toBe(false);
});
test("accepts a multibyte password at exactly the 1024-byte boundary", () => {
test("accepts a multibyte password at exactly the 1024-byte boundary", async () => {
const password = "é".repeat(512);
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$LfO3M3JBKeXf1knenCjQ6m9z4B7nedb0As2uc522I1I";
expect(Buffer.byteLength(password, "utf8")).toBe(1024);
expect(verifyPassword(password, passwordHash)).toBe(true);
expect(verifyPassword(`${password}é`, passwordHash)).toBe(false);
await expect(verifyPassword(password, passwordHash)).resolves.toBe(true);
await expect(verifyPassword(`${password}é`, passwordHash)).resolves.toBe(false);
});
test("rejects an over-limit password before converting it with Buffer.from", () => {
test("rejects an over-limit password before converting it with Buffer.from", async () => {
const password = "é".repeat(513);
const fromSpy = vi.spyOn(Buffer, "from");
try {
expect(Buffer.byteLength(password, "utf8")).toBe(1026);
expect(verifyPassword(password, vectors[0].phc)).toBe(false);
await expect(verifyPassword(password, vectors[0].phc)).resolves.toBe(false);
expect(fromSpy.mock.calls.some(([value, encoding]) => value === password && encoding === "utf8")).toBe(false);
} finally {
fromSpy.mockRestore();
}
});
test("rejects malformed and oversized PHC parameters before Argon2 allocation", () => {
test("rejects malformed and oversized PHC parameters before Argon2 allocation", async () => {
const password = vectors[0].password;
const digest = vectors[0].phc.split("$")[5];
const salt = vectors[0].phc.split("$")[4];
@@ -79,9 +79,9 @@ describe("local Argon2id password verification", () => {
];
for (const phc of cases) {
argon2SyncSpy.mockClear();
expect(verifyPassword(password, phc)).toBe(false);
expect(argon2SyncSpy).not.toHaveBeenCalled();
argon2Spy.mockClear();
await expect(verifyPassword(password, phc)).resolves.toBe(false);
expect(argon2Spy).not.toHaveBeenCalled();
}
});
});
+80
View File
@@ -0,0 +1,80 @@
import { afterAll, beforeAll, expect, test } from "vitest";
import { createLocalAuthFixture, type LocalAuthFixture, localPublicUrl } from "./auth-test-fixtures.js";
interface StateChangingRoute {
family: string;
method: "POST" | "PUT" | "DELETE";
url: string;
}
const stateChangingRoutes: readonly StateChangingRoute[] = [
{ family: "auth logout", method: "POST", url: "/auth/logout" },
{ family: "runtime prewarm", method: "POST", url: "/runtime/prewarm" },
{ family: "session create", method: "POST", url: "/sessions" },
{ family: "session mutation", method: "POST", url: "/sessions/session-1/response" },
{ family: "session mutation", method: "POST", url: "/sessions/session-1/steer" },
{ family: "session mutation", method: "POST", url: "/sessions/session-1/resume" },
{ family: "session mutation", method: "POST", url: "/sessions/session-1/close" },
{ family: "session mutation", method: "POST", url: "/sessions/session-1/rename" },
{ family: "session mutation", method: "POST", url: "/sessions/session-1/group" },
{ family: "session archive", method: "POST", url: "/sessions/session-1/archive" },
{ family: "session archive", method: "POST", url: "/sessions/session-1/unarchive" },
{ family: "session delete", method: "DELETE", url: "/sessions/session-1" },
{ family: "SQL preview", method: "POST", url: "/sessions/session-1/sql/preview" },
{ family: "SQL export", method: "POST", url: "/sessions/session-1/sql/export" },
{ family: "workspace registry", method: "POST", url: "/workspace-registry/pull" },
{ family: "workspace validation", method: "POST", url: "/workspaces/validate" },
{ family: "workspace secrets", method: "PUT", url: "/workspaces/workspace-1/secrets" },
{ family: "workspace secrets", method: "DELETE", url: "/workspaces/workspace-1/secrets/secret-1" },
{ family: "workspace diagnostics", method: "POST", url: "/workspaces/workspace-1/test" },
{ family: "settings", method: "PUT", url: "/settings" },
{ family: "Pi management", method: "PUT", url: "/pi-management/config" },
{ family: "Pi management", method: "POST", url: "/pi-management/test" },
{ family: "maintenance", method: "POST", url: "/internal/maintenance/activate" },
{ family: "maintenance", method: "POST", url: "/internal/maintenance/deactivate" },
];
let fixture: LocalAuthFixture;
beforeAll(async () => {
fixture = await createLocalAuthFixture();
});
afterAll(async () => {
await fixture.close();
});
test.each(stateChangingRoutes)(
"$family $method $url rejects every production CSRF/session-boundary failure before downstream code",
async ({ method, url }) => {
const failures = [
fixture.sessionHeaders({ "x-thothii-csrf": undefined }),
fixture.sessionHeaders({ "x-thothii-csrf": "malformed" }),
fixture.sessionHeaders({ origin: undefined }),
fixture.sessionHeaders({ origin: "http://wrong.example.test" }),
fixture.sessionHeaders({ "sec-fetch-site": "cross-site" }),
];
for (const headers of failures) {
fixture.resetDownstreamHits();
const response = await fixture.app.inject({ method, url, headers, payload: {} });
expect(response.statusCode).toBe(403);
expect(response.json()).toEqual({ code: "csrf_failed", error: "Request origin validation failed" });
expect(fixture.downstreamHits()).toBe(0);
}
},
);
test("a valid real local session cookie and derived CSRF token cross the same production boundary", async () => {
fixture.resetDownstreamHits();
const response = await fixture.app.inject({
method: "PUT",
url: "/settings",
headers: fixture.sessionHeaders(),
payload: {},
});
expect(response.statusCode).toBe(200);
expect(fixture.downstreamHits()).toBe(1);
expect(localPublicUrl).toBe("http://127.0.0.1:8787");
});
+74
View File
@@ -5,6 +5,7 @@ import { join } from "node:path";
import { stringify } from "yaml";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";
import { LoginFailureLimiter } from "../src/auth/routes.js";
const password = "correct horse battery staple";
const passwordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
@@ -270,6 +271,66 @@ test("failed logins are limited by normalized username and source address", asyn
expect((await login(addressLimited.app, { username: "A-new-username" })).statusCode).toBe(429);
});
test("failed-attempt limiter keeps exact bounded windows without check-time mutation or active-key eviction", () => {
const now = 1_000_000;
const limiter = new LoginFailureLimiter({ maximumEntries: 2 });
expect(limiter.isLimited("checked-only", "127.0.0.1", now)).toBe(false);
expect(limiter.recordFailure("victim", "127.0.0.1", now)).toBe(true);
expect(limiter.recordFailure("attacker", "127.0.0.1", now)).toBe(true);
expect(limiter.recordFailure("flood", "127.0.0.1", now)).toBe(false);
for (let attempt = 1; attempt < 10; attempt += 1) {
expect(limiter.recordFailure("victim", "127.0.0.1", now)).toBe(true);
}
expect(limiter.isLimited("victim", "127.0.0.1", now)).toBe(true);
expect(limiter.recordFailure("victim", "127.0.0.1", now)).toBe(false);
expect(limiter.isLimited("victim", "127.0.0.1", now + 10 * 60 * 1000 - 1)).toBe(true);
expect(limiter.isLimited("victim", "127.0.0.1", now + 10 * 60 * 1000)).toBe(false);
expect(limiter.recordFailure("victim", "127.0.0.1", now + 10 * 60 * 1000)).toBe(true);
});
test("failed-attempt limiter allows twenty source-address failures, then rejects the twenty-first", () => {
const limiter = new LoginFailureLimiter();
const now = 1_000_000;
for (let attempt = 0; attempt < 20; attempt += 1) {
expect(limiter.recordFailure(`user-${attempt}`, "127.0.0.1", now)).toBe(true);
}
expect(limiter.isLimited("new-user", "127.0.0.1", now)).toBe(true);
expect(limiter.recordFailure("new-user", "127.0.0.1", now)).toBe(false);
});
test("successful and pre-authentication failures never reset or consume failed-login counters", async () => {
let calls = 0;
const user = {
id: adminId, username: "Admin", normalizedUsername: "admin", displayName: "Local administrator",
passwordHash, roles: ["admin"], enabled: true, authRevision: 1,
};
const { app } = await createLocalApp({
registry: {
findByUsername: async () => user,
findBySubject: async () => user,
verify: async () => {
calls += 1;
return calls === 10;
},
},
});
const originRejected = await app.inject({
method: "POST", url: "/auth/local/login", headers: { origin: "http://wrong.example.test" },
payload: { username: "Admin", password },
});
expect(originRejected.statusCode).toBe(403);
expect(calls).toBe(0);
for (let attempt = 0; attempt < 9; attempt += 1) expect((await login(app)).statusCode).toBe(401);
expect((await login(app)).statusCode).toBe(200);
expect((await login(app)).statusCode).toBe(401);
expect((await login(app)).statusCode).toBe(429);
expect((await login(app)).statusCode).toBe(429);
});
test("only two Argon2 verifications run concurrently and excess login attempts fail immediately", async () => {
let calls = 0;
let release!: () => void;
@@ -302,6 +363,19 @@ test("only two Argon2 verifications run concurrently and excess login attempts f
expect((await second).statusCode).toBe(401);
});
test("the real native asynchronous Argon2 verifier holds two permits and releases them after completion", async () => {
const { app } = await createLocalApp();
const first = login(app, { password: `${password}!` });
const second = login(app, { password: `${password}!` });
await new Promise<void>((resolve) => setImmediate(resolve));
const excess = await login(app, { password: `${password}!` });
expect(excess.statusCode).toBe(429);
await expect(first).resolves.toMatchObject({ statusCode: 401 });
await expect(second).resolves.toMatchObject({ statusCode: 401 });
await expect(login(app, { password: `${password}!` })).resolves.toMatchObject({ statusCode: 401 });
});
test("a verifier failure is sanitized and releases its concurrency permit", async () => {
let attempts = 0;
const user = {
+112
View File
@@ -0,0 +1,112 @@
import { chmodSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import type { FastifyInstance } from "fastify";
import { stringify } from "yaml";
import { buildApp, type BuildAppDeps } from "../src/app.js";
import { loadConfig } from "../src/config.js";
export const localPassword = "correct horse battery staple";
export const localPasswordHash = "$argon2id$v=19$m=65536,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$DRo8ZSPI8G5OCvnFFapbVEjP69aDjy1Sw9i2743cPC4";
export const localAdminId = "6ba7b810-9dad-4ed1-80b4-00c04fd430c8";
export const localPublicUrl = "http://127.0.0.1:8787";
export interface LocalAuthFixture {
app: FastifyInstance;
cookie: string;
csrfToken: string;
downstreamHits(): number;
resetDownstreamHits(): void;
sessionHeaders(overrides?: Record<string, string | undefined>): Record<string, string>;
close(): Promise<void>;
}
function firstSetCookie(response: { headers: Record<string, string | string[] | undefined> }): string {
const header = response.headers["set-cookie"];
return Array.isArray(header) ? header[0] ?? "" : header ?? "";
}
function cookiePair(setCookie: string): string {
return setCookie.split(";", 1)[0] ?? "";
}
/** Creates a production-local app and authenticates through the real login/session boundary. */
export async function createLocalAuthFixture(deps?: BuildAppDeps): Promise<LocalAuthFixture> {
const directory = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-fixture-"));
chmodSync(directory, 0o700);
const authConfigFile = join(directory, "auth.yaml");
const usersFile = join(directory, "users.yaml");
writeFileSync(authConfigFile, stringify({
version: 1,
mode: "local",
publicUrl: localPublicUrl,
local: { usersFile: "users.yaml" },
}), { encoding: "utf8", mode: 0o600 });
writeFileSync(usersFile, [
"version: 1",
"users:",
` - id: ${localAdminId}`,
" username: Admin",
" displayName: Local administrator",
` passwordHash: ${localPasswordHash}`,
" roles:",
" - admin",
" enabled: true",
" authRevision: 1",
"",
].join("\n"), { encoding: "utf8", mode: 0o600 });
chmodSync(authConfigFile, 0o600);
chmodSync(usersFile, 0o600);
const app = buildApp(loadConfig({
THT_AUTH_CONFIG_FILE: authConfigFile,
THT_AUTH_STATE_ROOT: join(directory, "auth-state"),
THT_HARNESS_DIR: "/tmp/h",
}), deps);
let downstream = 0;
app.addHook("preHandler", async () => { downstream += 1; });
try {
const signedIn = await app.inject({
method: "POST",
url: "/auth/local/login",
headers: { origin: localPublicUrl, "sec-fetch-site": "same-origin" },
payload: { username: "Admin", password: localPassword },
});
if (signedIn.statusCode !== 200) throw new Error("local_auth_fixture_login_failed");
const cookie = cookiePair(firstSetCookie(signedIn));
const me = await app.inject({ method: "GET", url: "/me", headers: { cookie } });
const csrfToken = (me.json() as { csrfToken?: unknown }).csrfToken;
if (me.statusCode !== 200 || typeof csrfToken !== "string") throw new Error("local_auth_fixture_session_failed");
downstream = 0;
return {
app,
cookie,
csrfToken,
downstreamHits: () => downstream,
resetDownstreamHits: () => { downstream = 0; },
sessionHeaders(overrides = {}) {
const headers: Record<string, string> = {
cookie,
origin: localPublicUrl,
"sec-fetch-site": "same-origin",
"x-thothii-csrf": csrfToken,
};
for (const [key, value] of Object.entries(overrides)) {
if (value === undefined) delete headers[key];
else headers[key] = value;
}
return headers;
},
async close() {
await app.close();
rmSync(directory, { recursive: true, force: true });
},
};
} catch (error) {
await app.close();
rmSync(directory, { recursive: true, force: true });
throw error;
}
}