github-mirrors/netris-nestri
1
0
Fork 0
mirror of https://github.com/nestriness/nestri.git synced 2026-09-19 17:25:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): give a sign-in code a budget of guesses and a short life

Browse Source 
A six-digit code has a million values, and nothing was counting how many
of them a caller tried. The code travelled in an encrypted cookie the
caller held, verification compared against that cookie, and a wrong
answer simply re-rendered the form. Nobody has to be the person the code
was mailed to: type somebody else's address into the first screen and the
code goes to their mailbox while the cookie stays with you. At that point
the only thing between a stranger and an account is a million requests,
and the constant-time comparison protecting the code was guarding a door
you could just keep knocking on.

Guesses are now counted on the server, under a name that changes with
every code. That placement is the point: a counter kept beside the code,
in the cookie, is a counter the guesser can wind back by replaying an
older copy. Starting over is still allowed and still costs a fresh code
sent to the mailbox being aimed at, which is where somebody notices. A
correct code spends its record too, so its remaining guesses do not carry
into the next one.

The cookie also lived for twenty-four hours, which made the pin a
password with a million possible values and a day to try them. Ten
minutes now, and the code stops being accepted when the clock says so
rather than when the cookie happens to go away.

Resend had no limit either, so the button was a way to mail a stranger as
fast as requests go out. Codes to one address are spaced, and one attempt
at signing in can only ask for so many.

Both refusals say the same thing on purpose. Which of the two it was is a
fact about somebody else's mailbox.
This commit is contained in:
Wanjohi
2026-09-05 09:44:32 +03:00
parent 36179150a1
commit 355d1492d9
4 changed files with 395 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

167
packages/auth/src/provider/code.ts
View File

@@ -54,7 +54,8 @@
*/
import { Context } from 'hono';
import { generateUnbiasedDigits, timingSafeCompare } from '../random.js';
import { generateUnbiasedDigits, generateUnbiasedString, timingSafeCompare } from '../random.js';
import { Storage } from '../storage/storage.js';
import { Provider } from './provider.js';
export interface CodeProviderConfig<
@@ -66,6 +67,46 @@ export interface CodeProviderConfig<
* @default 6
*/
length?: number;
/**
* How long a code stays usable, in seconds.
*
* A pin is six digits, which is a small space, and the only thing keeping
* it small enough to type is that it does not have to last. A code that is
* still good tomorrow is a password with a million possible values.
*
* @default 600
*/
ttl?: number;
/**
* How many wrong guesses a code survives.
*
* Counted where the person asking cannot reach it, which is the whole
* point: the code itself travels in an encrypted cookie the caller holds,
* so a counter kept alongside it would be a counter they could reset by
* replaying an older copy. Starting over is allowed and costs them a fresh
* code — sent to the mailbox they are trying to break into, where somebody
* notices.
*
* @default 5
*/
maxAttempts?: number;
/**
* How many codes one attempt at signing in may ask for.
*
* @default 3
*/
maxSends?: number;
/**
* Seconds between one code and the next for the same claim.
*
* Without this, `resend` is an open relay pointed at anybody's mailbox: the
* address is not the caller's own and nothing asks them to prove otherwise,
* so the send button is a way to mail a stranger as fast as requests go
* out.
*
* @default 30
*/
resendInterval?: number;
/**
* The request handler to generate the UI for the code flow.
*
@@ -116,6 +157,14 @@ export type CodeProviderState =
resend?: boolean;
code: string;
claims: Record<string, string>;
/**
* Names the server-side record holding this code's remaining
* guesses. Regenerated with every code, so a caller who rolls back
* to an older cookie rolls back to a code that is no longer live.
*/
flow: string;
/** When the code stops being accepted, in ms. */
expires: number;
};
/**
@@ -134,16 +183,50 @@ export type CodeProviderError =
type: 'invalid_claim';
key: string;
value: string;
}
/** Too many guesses, or codes asked for too quickly. */
| {
type: 'rate_limit';
};
/** Nothing a person reads, so the whole alphabet is available. */
const FLOW_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
export function CodeProvider<Claims extends Record<string, string> = Record<string, string>>(
config: CodeProviderConfig<Claims>
): Provider<{ claims: Claims }> {
const length = config.length || 6;
const ttl = config.ttl ?? 60 * 10;
const maxAttempts = config.maxAttempts ?? 5;
const maxSends = config.maxSends ?? 3;
const resendInterval = config.resendInterval ?? 30;
function generate() {
return generateUnbiasedDigits(length);
}
/** Where a flow's remaining guesses live, on the server. */
function attemptKey(flow: string) {
return ['oauth:code:flow', flow];
}
/**
* Where the last send to one claim is remembered.
*
* Keyed by the claim and not by the caller, because the mailbox is what is
* being protected and the caller is whoever is pointing at it. Two people
* asking for a code for one address in the same minute is the case this is
* for, and it is the same case whether they are the same person or not.
*/
function claimKey(claims: Record<string, string>) {
const flattened = Object.entries(claims)
.filter(([key]) => key !== 'action')
.map(([key, value]) => `${key}=${String(value).trim().toLowerCase()}`)
.sort()
.join('&');
return ['oauth:code:claim', flattened];
}
return {
type: 'code',
init(routes, ctx) {
@@ -153,10 +236,14 @@ export function CodeProvider<Claims extends Record<string, string> = Record<stri
fd?: FormData,
err?: CodeProviderError
) {
await ctx.set<CodeProviderState>(c, 'provider', 60 * 60 * 24, next);
// The cookie lives exactly as long as the code inside it.
// Twenty-four hours, which is what this was, made a six-digit
// pin usable for a day.
await ctx.set<CodeProviderState>(c, 'provider', ttl, next);
const resp = ctx.forward(c, await config.request(c.req.raw, next, fd, err));
return resp;
}
routes.get('/authorize', async (c) => {
const resp = await transition(c, {
type: 'start'
@@ -165,7 +252,6 @@ export function CodeProvider<Claims extends Record<string, string> = Record<stri
});
routes.post('/authorize', async (c) => {
const code = generate();
const fd = await c.req.formData();
const state = await ctx.get<CodeProviderState>(c, 'provider');
const action = fd.get('action')?.toString();
@@ -173,22 +259,83 @@ export function CodeProvider<Claims extends Record<string, string> = Record<stri
if (action === 'request' || action === 'resend') {
const claims = Object.fromEntries(fd) as Claims;
delete claims.action;
// Asked for too soon, or too many times for one attempt.
// Both answers are the same on purpose: saying which would
// tell a caller whether the address they typed has had a
// code sent to it lately, which is a fact about somebody
// else's mailbox.
const sentAt = await Storage.get<{ at: number }>(ctx.storage, claimKey(claims));
if (sentAt && Date.now() - sentAt.at < resendInterval * 1000) {
return transition(c, state ?? { type: 'start' }, fd, { type: 'rate_limit' });
}
if (action === 'resend' && state?.type === 'code') {
const record = await Storage.get<{ attempts: number; sends: number }>(
ctx.storage,
attemptKey(state.flow)
);
if ((record?.sends ?? 1) >= maxSends) {
return transition(c, state, fd, { type: 'rate_limit' });
}
}
const code = generate();
const err = await config.sendCode(claims, code);
if (err) return transition(c, { type: 'start' }, fd, err);
// A new code means a new flow, which means a fresh budget
// of guesses — and, more to the point, that the budget
// attached to the previous code is now unreachable rather
// than reset.
const flow = generateUnbiasedString(FLOW_ALPHABET, 32);
const sends =
action === 'resend' && state?.type === 'code'
? ((
await Storage.get<{ sends: number }>(ctx.storage, attemptKey(state.flow))
)?.sends ?? 1) + 1
: 1;
await Storage.set(ctx.storage, attemptKey(flow), { attempts: 0, sends }, ttl);
await Storage.set(ctx.storage, claimKey(claims), { at: Date.now() }, resendInterval);
return transition(
c,
{
type: 'code',
resend: action === 'resend',
claims,
code
code,
flow,
expires: Date.now() + ttl * 1000
},
fd
);
}
if (fd.get('action')?.toString() === 'verify' && state.type === 'code') {
const fd = await c.req.formData();
if (action === 'verify' && state?.type === 'code') {
if (state.expires <= Date.now()) {
await ctx.unset(c, 'provider');
return transition(c, { type: 'start' }, fd, { type: 'invalid_code' });
}
// Counted before the comparison, so a guess costs whether or
// not it is right. Counted on the server, so the caller
// holding the cookie cannot wind it back.
const record = await Storage.get<{ attempts: number; sends: number }>(
ctx.storage,
attemptKey(state.flow)
);
if (!record || record.attempts >= maxAttempts) {
await ctx.unset(c, 'provider');
await Storage.remove(ctx.storage, attemptKey(state.flow));
return transition(c, { type: 'start' }, fd, { type: 'rate_limit' });
}
await Storage.set(
ctx.storage,
attemptKey(state.flow),
{ ...record, attempts: record.attempts + 1 },
Math.max(1, Math.ceil((state.expires - Date.now()) / 1000))
);
const compare = fd.get('code')?.toString();
if (!state.code || !compare || !timingSafeCompare(state.code, compare)) {
return transition(
@@ -201,12 +348,18 @@ export function CodeProvider<Claims extends Record<string, string> = Record<stri
{ type: 'invalid_code' }
);
}
// Spent. Without this the same code answers again, and the
// budget of guesses is per code rather than per sign-in.
await Storage.remove(ctx.storage, attemptKey(state.flow));
await ctx.unset(c, 'provider');
return ctx.forward(c, await ctx.success(c, { claims: state.claims as Claims }));
}
return transition(c, { type: 'start' }, fd);
});
}
};
};
}
/**

10
packages/auth/src/ui/code.tsx
View File

@@ -69,7 +69,13 @@ const DEFAULT_COPY = {
/**
* Copy for the resend button.
*/
code_resend: 'Resend'
code_resend: 'Resend',
/**
* Error message when too many codes have been asked for, or too many
* guesses made. Deliberately one message for both: which of the two it was
* is a fact about somebody else's mailbox.
*/
rate_limited: 'Too many attempts. Wait a moment and start again.'
};
export type CodeUICopy = typeof DEFAULT_COPY;
@@ -124,6 +130,7 @@ export function CodeUI(props: CodeUIOptions): CodeProviderOptions {
<Layout>
<form data-component="form" method="post">
{error?.type === 'invalid_claim' && <FormAlert message={copy.email_invalid} />}
{error?.type === 'rate_limit' && <FormAlert message={copy.rate_limited} />}
<input type="hidden" name="action" value="request" />
<input
data-component="input"
@@ -151,6 +158,7 @@ export function CodeUI(props: CodeUIOptions): CodeProviderOptions {
<Layout>
<form data-component="form" class="form" method="post">
{error?.type === 'invalid_code' && <FormAlert message={copy.code_invalid} />}
{error?.type === 'rate_limit' && <FormAlert message={copy.rate_limited} />}
{state.type === 'code' && (
<FormAlert
message={(state.resend ? copy.code_resent : copy.code_sent) + state.claims.email}