Add account version tags to cookies (#5563) * feat: add user account version to session cookie Co-authored-by: Copilot <copilot@github.com> * feat: include user handle in account version hash calculation * feat: refactor recovery code generation to use a dedicated function * fix: don't overwrite current session version if updating another user Co-authored-by: Copilot <copilot@github.com> * fix: reset session version instead of nullifying the entire session * fix: short circuit and clear cookie on request invalidation Co-authored-by: Copilot <copilot@github.com> * fix: update account version on recovery --------- Co-authored-by: Copilot <copilot@github.com>

c325c6d8e9d4c52974fe2f28700446cb1fbfa662

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

index.d.ts+4 -0 Viewed

              */
             handle: string | null;
             /**
+             * Account version tag: shake256 derivative of password hash and salt.
+             */
+            version: string | null;
+            /**
              * Last time the session was extended.
              */
             touch: number;

src/endpoints/users-private.js+8 -1 Viewed

 import storage from 'node-persist';
 import express from 'express';
-import { getUserAvatar, toKey, getPasswordHash, getPasswordSalt, createBackupArchive, ensurePublicDirectoriesExist, toAvatarKey } from '../users.js';
+import { getUserAvatar, toKey, getPasswordHash, getPasswordSalt, createBackupArchive, ensurePublicDirectoriesExist, toAvatarKey, getAccountVersion } from '../users.js';
 import { SETTINGS_FILE } from '../constants.js';
 import { checkForNewContent, CONTENT_TYPES } from './content-manager.js';
 import { color, Cache, getConfigValue } from '../util.js';

         request.session.handle = null;
         request.session.csrfToken = null;
+        request.session.version = null;
         request.session = null;
         return response.sendStatus(204);
     } catch (error) {

+        }
         await storage.setItem(toKey(request.body.handle), user);
+        // Update session version to keep the current session valid after password change
+        if (request.session && request.session.handle === user.handle) {
+            request.session.version = getAccountVersion(user);
+        }
         return response.sendStatus(204);
     } catch (error) {
         console.error(error);

src/endpoints/users-public.js+9 -2 Viewed

 import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible';
 import { getIpAddress, retryAfter } from '../express-common.js';
 import { color, Cache, getConfigValue } from '../util.js';
-import { KEY_PREFIX, getUserAvatar, toKey, getPasswordHash, getPasswordSalt } from '../users.js';
+import { KEY_PREFIX, getUserAvatar, toKey, getPasswordHash, getPasswordSalt, getAccountVersion } from '../users.js';
 const DISCREET_LOGIN = getConfigValue('enableDiscreetLogin', false, 'boolean');
 const PREFER_REAL_IP_HEADER = getConfigValue('rateLimiting.preferRealIpHeader', false, 'boolean');

 const RECOVER_POINTS = getConfigValue('rateLimiting.accountsRecoverMaxAttempts', 5, 'number');
 const MFA_CACHE = new Cache(5 * 60 * 1000);
+const generateRecoveryCode = () => Array.from({ length: 6 }, () => crypto.randomInt(0, 10)).join('');
 export const router = express.Router();
 const loginLimiter = new RateLimiterMemory({
     points: LOGIN_POINTS > 0 ? LOGIN_POINTS : Number.MAX_SAFE_INTEGER,

         await loginLimiter.delete(ip);
         request.session.handle = user.handle;
+        request.session.version = getAccountVersion(user);
         console.info('Login successful:', user.handle, 'from', ip, 'at', new Date().toLocaleString());
         return response.json({ handle: user.handle });
     } catch (error) {

             return response.status(403).json({ error: 'User is disabled' });
+        }
-        const mfaCode = String(crypto.randomInt(1000, 9999));
+        const mfaCode = generateRecoveryCode();
         console.log();
         console.log(color.blue(`${user.name}, your password recovery code is: `) + color.magenta(mfaCode));
         console.log();

             await storage.setItem(toKey(user.handle), user);
+        }
+        if (request.session && request.session.handle === user.handle) {
+            request.session.version = getAccountVersion(user);
+        }
         await recoverLimiter.delete(ip);
         MFA_CACHE.remove(user.handle);
         return response.sendStatus(204);

src/users.js+28 -0 Viewed

@@ -788,6 +788,7 @@ async function singleUserLogin(request) {
788	const user = await storage.getItem(toKey(userHandles[0]));	788	const user = await storage.getItem(toKey(userHandles[0]));
789	if (user && !user.password) {	789	if (user && !user.password) {
790	request.session.handle = userHandles[0];	790	request.session.handle = userHandles[0];
		791	request.session.version = getAccountVersion(user);
791	return true;	792	return true;
792	}	793	}
793	}	794	}

@@ -882,6 +883,7 @@ async function headerUserLogin(request, header = 'Remote-User') {
882	const user = await storage.getItem(toKey(userHandle));	883	const user = await storage.getItem(toKey(userHandle));
883	if (user && user.enabled) {	884	if (user && user.enabled) {
884	request.session.handle = userHandle;	885	request.session.handle = userHandle;
		886	request.session.version = getAccountVersion(user);
885	return true;	887	return true;
886	}	888	}
887	}	889	}

@@ -923,6 +925,7 @@ async function basicUserLogin(request) {
923	// Verify pass again here just to be sure	925	// Verify pass again here just to be sure
924	if (user && user.enabled && user.password && user.password === getPasswordHash(password, user.salt)) {	926	if (user && user.enabled && user.password && user.password === getPasswordHash(password, user.salt)) {
925	request.session.handle = userHandle;	927	request.session.handle = userHandle;
		928	request.session.version = getAccountVersion(user);
926	return true;	929	return true;
927	}	930	}
928	}	931	}

+}
 /**
+ * Gets the account version tag for the provided user.
+ * @param {User} user User account object
+ * @returns {string} Account version tag
+ */
+export function getAccountVersion(user) {
+    return crypto.createHash('shake256', { outputLength: 8 })
+        .update(JSON.stringify([user.handle, user.password, user.salt]))
+        .digest('hex');
+}
+/**
  * Middleware to add user data to the request object.
  * @param {import('express').Request} request Request object
  * @param {import('express').Response} response Response object

         return next();
+    }
+    if (Object.hasOwn(request.session, 'version')) {
+        if (request.session.version !== getAccountVersion(user)) {
+            console.warn('User data has changed since the session was created. Invalidating session for user:', handle);
+            request.session.handle = null;
+            request.session.csrfToken = null;
+            request.session.version = null;
+            request.session = null;
+            return response.sendStatus(403);
+        }
+    } else {
+        // If there is no version in the session, it means it's an old session. Upgrade it by adding the version.
+        request.session.version = getAccountVersion(user);
+    }
     const directories = getUserDirectories(handle);
     request.user = {
         profile: user,