Add account version tags to cookies (#5563) * feat: add user account version to session cookie Co-authored-by: Copilot <copilot@github.com> * feat: include user handle in account version hash calculation * feat: refactor recovery code generation to use a dedicated function * fix: don't overwrite current session version if updating another user Co-authored-by: Copilot <copilot@github.com> * fix: reset session version instead of nullifying the entire session * fix: short circuit and clear cookie on request invalidation Co-authored-by: Copilot <copilot@github.com> * fix: update account version on recovery --------- Co-authored-by: Copilot <copilot@github.com>

c325c6d8e9d4c52974fe2f28700446cb1fbfa662

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

index.d.ts+4 -0 Viewed

              */
             handle: string | null;
             /**
 +             * Account version tag: shake256 derivative of password hash and salt.
 +             */
 +            version: string | null;
 +            /**
              * Last time the session was extended.
              */
             touch: number;

src/endpoints/users-private.js+8 -1 Viewed

 import storage from 'node-persist';
 import express from 'express';
 import { getUserAvatar, toKey, getPasswordHash, getPasswordSalt, createBackupArchive, ensurePublicDirectoriesExist, toAvatarKey, getAccountVersion } from '../users.js';
 import { SETTINGS_FILE } from '../constants.js';
 import { checkForNewContent, CONTENT_TYPES } from './content-manager.js';
 import { color, Cache, getConfigValue } from '../util.js';

         request.session.handle = null;
         request.session.csrfToken = null;
 +        request.session.version = null;
         request.session = null;
         return response.sendStatus(204);
     } catch (error) {

+        }
         await storage.setItem(toKey(request.body.handle), user);
++
 +        // Update session version to keep the current session valid after password change
 +        if (request.session && request.session.handle === user.handle) {
 +            request.session.version = getAccountVersion(user);
 +        }
++
         return response.sendStatus(204);
     } catch (error) {
         console.error(error);

src/endpoints/users-public.js+9 -2 Viewed

 import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible';
 import { getIpAddress, retryAfter } from '../express-common.js';
 import { color, Cache, getConfigValue } from '../util.js';
 import { KEY_PREFIX, getUserAvatar, toKey, getPasswordHash, getPasswordSalt, getAccountVersion } from '../users.js';
 const DISCREET_LOGIN = getConfigValue('enableDiscreetLogin', false, 'boolean');
 const PREFER_REAL_IP_HEADER = getConfigValue('rateLimiting.preferRealIpHeader', false, 'boolean');

 const RECOVER_POINTS = getConfigValue('rateLimiting.accountsRecoverMaxAttempts', 5, 'number');
 const MFA_CACHE = new Cache(5 * 60 * 1000);
 +const generateRecoveryCode = () => Array.from({ length: 6 }, () => crypto.randomInt(0, 10)).join('');
++
 export const router = express.Router();
 const loginLimiter = new RateLimiterMemory({
     points: LOGIN_POINTS > 0 ? LOGIN_POINTS : Number.MAX_SAFE_INTEGER,

         await loginLimiter.delete(ip);
         request.session.handle = user.handle;
 +        request.session.version = getAccountVersion(user);
         console.info('Login successful:', user.handle, 'from', ip, 'at', new Date().toLocaleString());
         return response.json({ handle: user.handle });
     } catch (error) {

             return response.status(403).json({ error: 'User is disabled' });
+        }
         const mfaCode = String(crypto.randomIntgenerateRecoveryCode(1000, 9999));
         console.log();
         console.log(color.blue(`${user.name}, your password recovery code is: `) + color.magenta(mfaCode));
         console.log();

             await storage.setItem(toKey(user.handle), user);
+        }
 +        if (request.session && request.session.handle === user.handle) {
 +            request.session.version = getAccountVersion(user);
 +        }
++
         await recoverLimiter.delete(ip);
         MFA_CACHE.remove(user.handle);
         return response.sendStatus(204);

src/users.js+28 -0 Viewed

@@ -788,6 +788,7 @@ async function singleUserLogin(request) {
788	788	const user = await storage.getItem(toKey(userHandles[0]));
789	789	if (user && !user.password) {
790	790	request.session.handle = userHandles[0];
	791	+ request.session.version = getAccountVersion(user);
791	792	return true;
792	793	}
793	794	}

@@ -882,6 +883,7 @@ async function headerUserLogin(request, header = 'Remote-User') {
882	883	const user = await storage.getItem(toKey(userHandle));
883	884	if (user && user.enabled) {
884	885	request.session.handle = userHandle;
	886	+ request.session.version = getAccountVersion(user);
885	887	return true;
886	888	}
887	889	}

@@ -923,6 +925,7 @@ async function basicUserLogin(request) {
923	925	// Verify pass again here just to be sure
924	926	if (user && user.enabled && user.password && user.password === getPasswordHash(password, user.salt)) {
925	927	request.session.handle = userHandle;
	928	+ request.session.version = getAccountVersion(user);
926	929	return true;
927	930	}
928	931	}

+}
 /**
 + * Gets the account version tag for the provided user.
 + * @param {User} user User account object
 + * @returns {string} Account version tag
 + */
 +export function getAccountVersion(user) {
 +    return crypto.createHash('shake256', { outputLength: 8 })
 +        .update(JSON.stringify([user.handle, user.password, user.salt]))
 +        .digest('hex');
 +}
++
 +/**
  * Middleware to add user data to the request object.
  * @param {import('express').Request} request Request object
  * @param {import('express').Response} response Response object

         return next();
+    }
 +    if (Object.hasOwn(request.session, 'version')) {
 +        if (request.session.version !== getAccountVersion(user)) {
 +            console.warn('User data has changed since the session was created. Invalidating session for user:', handle);
 +            request.session.handle = null;
 +            request.session.csrfToken = null;
 +            request.session.version = null;
 +            request.session = null;
 +            return response.sendStatus(403);
 +        }
 +    } else {
 +        // If there is no version in the session, it means it's an old session. Upgrade it by adding the version.
 +        request.session.version = getAccountVersion(user);
 +    }
++
     const directories = getUserDirectories(handle);
     request.user = {
         profile: user,