From bb68cb6ef9c28d6663a3bcf6fa3baab061f8bfe5 Mon Sep 17 00:00:00 2001 From: kedarchandrayan Date: Thu, 18 Aug 2022 14:06:57 +0530 Subject: [PATCH 1/2] Feature add 'Encryption Based Token Pattern' and 'HMAC Based Token Pattern' --- README.md | 40 +++++-- index.js | 37 ++++--- test/testEncrypted.js | 211 +++++++++++++++++++++++++++++++++++++ test/testHmac.js | 212 ++++++++++++++++++++++++++++++++++++++ tokenManager/Encrypted.js | 86 ++++++++++++++++ tokenManager/Factory.js | 28 +++++ tokenManager/Hmac.js | 75 ++++++++++++++ 7 files changed, 667 insertions(+), 22 deletions(-) create mode 100644 test/testEncrypted.js create mode 100644 test/testHmac.js create mode 100644 tokenManager/Encrypted.js create mode 100644 tokenManager/Factory.js create mode 100644 tokenManager/Hmac.js diff --git a/README.md b/README.md index 7820251..8a6226c 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,9 @@ Node.js [CSRF][wikipedia-csrf] protection middleware. -Requires either a session middleware or [cookie-parser](https://www.npmjs.com/package/cookie-parser) to be initialized first. +If not using stateless CSRF token patterns ([HMAC based token pattern][owasp-csrf-hmac-based-token] or +[Encryption based token pattern][owasp-csrf-encryption-based-token]), it requires either a session middleware +or [cookie-parser](https://www.npmjs.com/package/cookie-parser) to be initialized first. * If you are setting the ["cookie" option](#cookie) to a non-`false` value, then you must use [cookie-parser](https://www.npmjs.com/package/cookie-parser) @@ -40,19 +42,31 @@ var csurf = require('csurf') Create a middleware for CSRF token creation and validation. This middleware adds a `req.csrfToken()` function to make a token which should be added to requests which mutate state, within a hidden form field, query-string etc. -This token is validated against the visitor's session or csrf cookie. #### Options The `csurf` function takes an optional `options` object that may contain any of the following keys: +##### csrfTokenPattern + +Determines the CSRF token pattern to use. +Pass `hmac` for [HMAC based token pattern][owasp-csrf-hmac-based-token]. +Pass `encrypted` for [Encryption based token pattern][owasp-csrf-encryption-based-token] +Defaults to [double submit cookie pattern][owsap-csrf-double-submit]. + +NOTE: In case of HMAC based token pattern, +`req._csrfUserId`, `req._csrfNonce` and `req._csrfOperation` are used to generate the token. Also, `req._csrfUserId` +is used for verifying the token value. + +NOTE: In case of Encryption based token pattern, +`req._csrfUserId` and `req._csrfNonce` are used to generate the token. Also, `req._csrfUserId` +is used for verifying the token value. + ##### cookie Determines if the token secret for the user should be stored in a cookie -or in `req.session`. Storing the token secret in a cookie implements -the [double submit cookie pattern][owsap-csrf-double-submit]. -Defaults to `false`. +or in `req.session`. Defaults to `false`. This option makes no difference in case `csrfTokenPattern` is `hmac` or `encrypted`. When set to `true` (or an object of options for the cookie), then the module changes behavior and no longer uses `req.session`. This means you _are no @@ -93,7 +107,7 @@ Defaults to `'session'` (i.e. looks at `req.session`). The CSRF secret from this library is stored and read as `req[sessionKey].csrfSecret`. If the ["cookie" option](#cookie) is not `false`, then this option does -nothing. +nothing. This option makes no difference in case `csrfTokenPattern` is `hmac` or `encrypted`. ##### value @@ -112,6 +126,18 @@ locations, in order: - `req.headers['x-csrf-token']` - the `X-CSRF-Token` HTTP request header. - `req.headers['x-xsrf-token']` - the `X-XSRF-Token` HTTP request header. +##### hmacSecret + +Applicable only if `csrfTokenPattern` is `hmac`. This is secret known only to the server and is used in the HMAC algorithm. + +##### encryptionKey + +Applicable only if `csrfTokenPattern` is `encrypted`. This is secret key known only to the server and is used in the Encryption algorithm (aes-256-cbc). + +##### expiry + +Applicable only if `csrfTokenPattern` is `hmac` or `encrypted`. This is the token expiry in seconds. Expired tokens are rejected. + ## Example ### Simple express example @@ -306,6 +332,8 @@ app.use(function (err, req, res, next) { [owsap-csrf]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html [owsap-csrf-double-submit]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie +[owasp-csrf-hmac-based-token]: https://owasp.deteact.com/cheat/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#hmac-based-token-pattern +[owasp-csrf-encryption-based-token]: https://owasp.deteact.com/cheat/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#encryption-based-token-pattern [wikipedia-csrf]: https://en.wikipedia.org/wiki/Cross-site_request_forgery ## License diff --git a/index.js b/index.js index 367bdba..6c50dd1 100644 --- a/index.js +++ b/index.js @@ -16,7 +16,7 @@ var Cookie = require('cookie') var createError = require('http-errors') var sign = require('cookie-signature').sign -var Tokens = require('csrf') +var TokenManagerFactory = require('./tokenManager/Factory') /** * Module exports. @@ -50,8 +50,10 @@ function csurf (options) { // get value getter var value = opts.value || defaultValue + var isStatelessPattern = opts.csrfTokenPattern === 'hmac' || opts.csrfTokenPattern === 'encrypted' + // token repo - var tokens = new Tokens(opts) + var tokenManager = new TokenManagerFactory(opts).getTokenManager() // ignored methods var ignoreMethods = opts.ignoreMethods === undefined @@ -66,18 +68,21 @@ function csurf (options) { var ignoreMethod = getIgnoredMethods(ignoreMethods) return function csrf (req, res, next) { - // validate the configuration against request - if (!verifyConfiguration(req, sessionKey, cookie)) { - return next(new Error('misconfigured csrf')) - } + var token, secret - // get the secret from the request - var secret = getSecret(req, sessionKey, cookie) - var token + if (!isStatelessPattern) { + // validate the configuration against request + if (!verifyConfiguration(req, sessionKey, cookie)) { + return next(new Error('misconfigured csrf')) + } + + // get the secret from the request + secret = getSecret(req, sessionKey, cookie) + } // lazy-load token getter req.csrfToken = function csrfToken () { - var sec = !cookie + var sec = !cookie && !isStatelessPattern ? getSecret(req, sessionKey, cookie) : secret @@ -87,8 +92,8 @@ function csurf (options) { } // generate & set new secret - if (sec === undefined) { - sec = tokens.secretSync() + if (sec === undefined && !isStatelessPattern) { + sec = tokenManager.secretSync() setSecret(req, res, sessionKey, sec, cookie) } @@ -96,19 +101,19 @@ function csurf (options) { secret = sec // create new token - token = tokens.create(secret) + token = tokenManager.create(secret, req) return token } // generate & set secret - if (!secret) { - secret = tokens.secretSync() + if (!secret && !isStatelessPattern) { + secret = tokenManager.secretSync() setSecret(req, res, sessionKey, secret, cookie) } // verify the incoming token - if (!ignoreMethod[req.method] && !tokens.verify(secret, value(req))) { + if (!ignoreMethod[req.method] && !tokenManager.verify(secret, value(req), req)) { return next(createError(403, 'invalid csrf token', { code: 'EBADCSRFTOKEN' })) diff --git a/test/testEncrypted.js b/test/testEncrypted.js new file mode 100644 index 0000000..54af3a4 --- /dev/null +++ b/test/testEncrypted.js @@ -0,0 +1,211 @@ + +process.env.NODE_ENV = 'test' + +var connect = require('connect') +var http = require('http') +var bodyParser = require('body-parser') +var querystring = require('querystring') +var request = require('supertest') + +var csurf = require('..') + +describe('csurf with Encryption based token pattern', function () { + it('should work in req.body', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .send('_csrf=' + encodeURIComponent(token)) + .expect(200, done) + }) + }) +}) + +it('should work in req.query', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/?_csrf=' + encodeURIComponent(token)) + .expect(200, done) + }) +}) + +it('should work in csrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('csrf-token', token) + .expect(200, done) + }) +}) + +it('should work in xsrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('xsrf-token', token) + .expect(200, done) + }) +}) + +it('should work in x-csrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('x-csrf-token', token) + .expect(200, done) + }) +}) + +it('should work in x-xsrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('x-xsrf-token', token) + .expect(200, done) + }) +}) + +it('should fail with an invalid token', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + request(server) + .post('/') + .set('X-CSRF-Token', '42') + .expect(403, done) + }) +}) + +it('should fail with no token', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + request(server) + .post('/') + .expect(403, done) + }) +}) + +it('should fail with expired token', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'encrypted', + encryptionKey: '5e91b89e38697ee924ba9b9940217cf654ecdeed4dc0f551a88c3b7f577469f0', + expiry: 0.5 + }) + + // Token expiry is 0.5 seconds and we use it after 1 second. + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + setTimeout(function () { + request(server) + .post('/') + .set('x-xsrf-token', token) + .expect(403, done) + }, 1000) + }) +}) + +function createServerWithoutCookieAndSession (opts) { + var app = connect() + + app.use(function (req, res, next) { + var index = req.url.indexOf('?') + 1 + + if (index) { + req.query = querystring.parse(req.url.substring(index)) + } + + next() + }) + app.use(bodyParser.urlencoded({ extended: false })) + + app.use(function(req, res, next) { + req._csrfUserId = 123 + req._csrfNonce = 1 + next() + }) + + app.use(csurf(opts)) + + app.use(function (req, res) { + res.end(req.csrfToken() || 'none') + }) + + return http.createServer(app) +} diff --git a/test/testHmac.js b/test/testHmac.js new file mode 100644 index 0000000..4bfbb10 --- /dev/null +++ b/test/testHmac.js @@ -0,0 +1,212 @@ + +process.env.NODE_ENV = 'test' + +var connect = require('connect') +var http = require('http') +var bodyParser = require('body-parser') +var querystring = require('querystring') +var request = require('supertest') + +var csurf = require('..') + +describe('csurf with HMAC based token pattern', function () { + it('should work in req.body', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .send('_csrf=' + encodeURIComponent(token)) + .expect(200, done) + }) + }) +}) + +it('should work in req.query', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/?_csrf=' + encodeURIComponent(token)) + .expect(200, done) + }) +}) + +it('should work in csrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('csrf-token', token) + .expect(200, done) + }) +}) + +it('should work in xsrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('xsrf-token', token) + .expect(200, done) + }) +}) + +it('should work in x-csrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('x-csrf-token', token) + .expect(200, done) + }) +}) + +it('should work in x-xsrf-token header', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + request(server) + .post('/') + .set('x-xsrf-token', token) + .expect(200, done) + }) +}) + +it('should fail with an invalid token', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + request(server) + .post('/') + .set('X-CSRF-Token', '42') + .expect(403, done) + }) +}) + +it('should fail with no token', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1' + }) + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + request(server) + .post('/') + .expect(403, done) + }) +}) + +it('should fail with expired token', function (done) { + var server = createServerWithoutCookieAndSession({ + csrfTokenPattern: 'hmac', + hmacSecret: 'e92633a08116905e4f30eefd1', + expiry: 0.5 + }) + + // Token expiry is 0.5 seconds and we use it after 1 second. + + request(server) + .get('/') + .expect(200, function (err, res) { + if (err) return done(err) + var token = res.text + + setTimeout(function () { + request(server) + .post('/') + .set('x-xsrf-token', token) + .expect(403, done) + }, 1000) + }) +}) + +function createServerWithoutCookieAndSession (opts) { + var app = connect() + + app.use(function (req, res, next) { + var index = req.url.indexOf('?') + 1 + + if (index) { + req.query = querystring.parse(req.url.substring(index)) + } + + next() + }) + app.use(bodyParser.urlencoded({ extended: false })) + + app.use(function(req, res, next) { + req._csrfUserId = 123 + req._csrfNonce = 1 + req._csrfOperation = 'test' + next() + }) + + app.use(csurf(opts)) + + app.use(function (req, res) { + res.end(req.csrfToken() || 'none') + }) + + return http.createServer(app) +} diff --git a/tokenManager/Encrypted.js b/tokenManager/Encrypted.js new file mode 100644 index 0000000..0808046 --- /dev/null +++ b/tokenManager/Encrypted.js @@ -0,0 +1,86 @@ +const Crypto = require('crypto') + +const ALGORITHM = 'aes-256-cbc' +const IV_LENGTH = 16 + +/** + * Encrypted Token Manager + */ +class EncryptedTokenManager { + constructor (opts) { + this.opts = opts + + this.encryptionKey = this.opts.encryptionKey + this.expiry = this.opts.expiry || 60 * 60 // 1 hours default value + } + + /** + * Verify secret + * + * @param {string} secret + * @param {string} token + * @param {IncomingMessage} req + * @returns {boolean} + */ + verify (secret, token, req) { + if (!token) return false + + const encryptionKey = this.encryptionKey + let decrypted + + try { + const [iv, encryptedText] = token.split(':').map(part => Buffer.from(part, 'hex')) + const decipher = Crypto.createDecipheriv(ALGORITHM, Buffer.from(encryptionKey, 'hex'), iv) + decrypted = decipher.update(encryptedText) + decrypted = (Buffer.concat([decrypted, decipher.final()])).toString() + } catch (e) { + return false + } + + const tokenParts = decrypted.split(':') + if (tokenParts.length !== 3) return false + + const csrfUserId = tokenParts[0] + const timestamp = tokenParts[2] + + // Check for token expiry + if (Math.floor(Date.now() / 1000) - timestamp > this.expiry) return false + + // Check for csrfUserId + return this._sanitize(req._csrfUserId) === csrfUserId + } + + /** + * Returns token + * + * @param {String} secret + * @param {IncomingMessage} req + * @return {String} + */ + create (secret, req) { + const encryptionKey = this.encryptionKey + const csrfUserId = this._sanitize(req._csrfUserId) + const csrfNonce = this._sanitize(req._csrfNonce) + + const text = `${csrfUserId}:${csrfNonce}:${Math.floor(Date.now() / 1000)}` + const iv = Crypto.randomBytes(IV_LENGTH) + const cipher = Crypto.createCipheriv(ALGORITHM, Buffer.from(encryptionKey, 'hex'), iv) + let encrypted = cipher.update(text) + encrypted = Buffer.concat([encrypted, cipher.final()]) + + return `${iv.toString('hex')}:${encrypted.toString('hex')}` + } + + /** + * Returns sanitized string + * + * @param {string} str + * @returns {string} + * @private + */ + _sanitize (str) { + return `${str}`.replace(/\s+/g, '_').replace(/:+/g, '_') + } +} + +module.exports = EncryptedTokenManager diff --git a/tokenManager/Factory.js b/tokenManager/Factory.js new file mode 100644 index 0000000..b199865 --- /dev/null +++ b/tokenManager/Factory.js @@ -0,0 +1,28 @@ +const DoubleSubmitTokenManager = require('csrf') +const HmacTokenManager = require('./Hmac') +const EncryptedTokenManager = require('./Encrypted') + +/** + * Token Manager Factory class for providing token manager object based on CSRF token pattern + */ +class TokenManagerFactory { + constructor (opts) { + this.opts = opts || {} + this.csrfTokenPattern = this.opts.csrfTokenPattern + } + + /** + * Get token manager object + */ + getTokenManager () { + if (this.csrfTokenPattern === 'hmac') { + return new HmacTokenManager(this.opts) + } else if (this.csrfTokenPattern === 'encrypted') { + return new EncryptedTokenManager(this.opts) + } else { // If not passed, treat double submit token manager as default. + return new DoubleSubmitTokenManager(this.opts) + } + } +} + +module.exports = TokenManagerFactory diff --git a/tokenManager/Hmac.js b/tokenManager/Hmac.js new file mode 100644 index 0000000..ff4499c --- /dev/null +++ b/tokenManager/Hmac.js @@ -0,0 +1,75 @@ +const Crypto = require('crypto') + +/** + * HMAC Token Manager + */ +class HmacTokenManager { + constructor (opts) { + this.opts = opts + + this.hmacSecret = this.opts.hmacSecret + this.expiry = this.opts.expiry || 60 * 60 // 1 hours default value + } + + /** + * Verify secret + * + * @param {string} secret + * @param {string} token + * @param {IncomingMessage} req + * @returns {boolean} + */ + verify (secret, token, req) { + if (!token) return false + + const tokenParts = token.split(':') + if (tokenParts.length !== 5) return false + + const csrfUserId = tokenParts[0] + const csrfNonce = tokenParts[1] + const csrfOperation = tokenParts[2] + const timestamp = tokenParts[3] + + // Check for token expiry + if (Math.floor(Date.now() / 1000) - timestamp > this.expiry) return false + + // Check for csrfUserId + if (this._sanitize(req._csrfUserId) !== csrfUserId) return false + + return this.create('dummy', { + _csrfUserId: csrfUserId, + _csrfNonce: csrfNonce, + _csrfOperation: csrfOperation + }, timestamp) === token + } + + /** + * Returns token + * + * @param {String} secret + * @param {IncomingMessage} req + * @param {number} timestamp + * @return {String} + */ + create (secret, req, timestamp = Math.floor(Date.now() / 1000)) { + const csrfUserId = this._sanitize(req._csrfUserId) + const csrfNonce = this._sanitize(req._csrfNonce) + const csrfOperation = this._sanitize(req._csrfOperation) + + const prefix = `${csrfUserId}:${csrfNonce}:${csrfOperation}:${timestamp}` + return prefix + ':' + Crypto.createHmac('sha256', this.hmacSecret).update(prefix).digest('hex') + } + + /** + * Returns sanitized string + * + * @param {string} str + * @returns {string} + * @private + */ + _sanitize (str) { + return `${str}`.replace(/\s+/g, '_').replace(/:+/g, '_') + } +} + +module.exports = HmacTokenManager From 81bea31cbfd19326324eb98f846edeeba6aebf8f Mon Sep 17 00:00:00 2001 From: kedarchandrayan Date: Mon, 5 Sep 2022 17:13:15 +0530 Subject: [PATCH 2/2] Feature add 'Encryption Based Token Pattern' and 'HMAC Based Token Pattern' - changes to HISTORY.md --- HISTORY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/HISTORY.md b/HISTORY.md index 59f844c..07bf2db 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -5,6 +5,7 @@ unreleased - Fix `maxAge` option to reject invalid values * deps: http-errors@1.8.0 - deps: setprototypeof@1.2.0 + * Allow selection of `csrfTokenPattern`. Support for HMAC based token pattern and encryption based token pattern added. Defaults to double submit cookie pattern. 1.11.0 / 2020-01-18 ===================