Stabilize auth session cookies per server mode (#1898)

Julius Marminge committed 7 months ago

Commit 4ae9de31 parent 5fa09fa11 files · +212 −22Browse files

Showing the changes to apps/server/src (6 of 11 files). Show all

Unified · Split

6 files

apps/server/src/auth/Layers/ServerAuth.ts +11 −1
apps/server/src/auth/Layers/ServerAuthPolicy.test.ts +3 −0
apps/server/src/auth/Layers/ServerAuthPolicy.ts +5 −2
apps/server/src/auth/Layers/SessionCredentialService.ts +8 −2
apps/server/src/auth/utils.ts +12 −1
apps/server/src/server.test.ts +1 −1

apps/server/src/auth/Layers/ServerAuth.ts+11−1

   AuthError,
   type ServerAuthShape,
 } from "../Services/ServerAuth.ts";
-import { SessionCredentialService } from "../Services/SessionCredentialService.ts";
+import {
+  SessionCredentialError,
+  SessionCredentialService,
+} from "../Services/SessionCredentialService.ts";
 import { AuthControlPlaneLive, AuthCoreLive } from "./AuthControlPlane.ts";
 type BootstrapExchangeResult = {
   const authenticateToken = (token: string): Effect.Effect<AuthenticatedSession, AuthError> =>
     sessions.verify(token).pipe(
+      Effect.tapError((cause: SessionCredentialError) =>
+        Effect.logWarning("Rejected authenticated session credential.").pipe(
+          Effect.annotateLogs({
+            reason: cause.message,
+          }),
+        ),
+      ),
       Effect.map((session) => ({
         sessionId: session.sessionId,
         subject: session.subject,

apps/server/src/auth/Layers/ServerAuthPolicy.test.ts+3−0

       expect(descriptor.policy).toBe("desktop-managed-local");
       expect(descriptor.bootstrapMethods).toEqual(["desktop-bootstrap"]);
+      expect(descriptor.sessionCookieName).toBe("t3_session_3773");
     }).pipe(
       Effect.provide(
         makeServerAuthPolicyLayer({
           mode: "desktop",
+          port: 3773,
         }),
       ),
     ),
       expect(descriptor.policy).toBe("loopback-browser");
       expect(descriptor.bootstrapMethods).toEqual(["one-time-token"]);
+      expect(descriptor.sessionCookieName).toBe("t3_session");
     }).pipe(
       Effect.provide(
         makeServerAuthPolicyLayer({

apps/server/src/auth/Layers/ServerAuthPolicy.ts+5−2

 import { ServerConfig } from "../../config.ts";
 import { ServerAuthPolicy, type ServerAuthPolicyShape } from "../Services/ServerAuthPolicy.ts";
-import { SESSION_COOKIE_NAME } from "../utils.ts";
+import { resolveSessionCookieName } from "../utils.ts";
 import { isLoopbackHost, isWildcardHost } from "../../startupAccess.ts";
 export const makeServerAuthPolicy = Effect.gen(function* () {
     policy,
     bootstrapMethods,
     sessionMethods: ["browser-session-cookie", "bearer-session-token"],
-    sessionCookieName: SESSION_COOKIE_NAME,
+    sessionCookieName: resolveSessionCookieName({
+      mode: config.mode,
+      port: config.port,
+    }),
   };
   return {

apps/server/src/auth/Layers/SessionCredentialService.ts+8−2

 import { Clock, DateTime, Duration, Effect, Layer, PubSub, Ref, Schema, Stream } from "effect";
 import { Option } from "effect";
+import { ServerConfig } from "../../config.ts";
 import { AuthSessionRepositoryLive } from "../../persistence/Layers/AuthSessions.ts";
 import { AuthSessionRepository } from "../../persistence/Services/AuthSessions.ts";
 import { ServerSecretStore } from "../Services/ServerSecretStore.ts";
-import { SESSION_COOKIE_NAME } from "../utils.ts";
 import {
   SessionCredentialError,
   SessionCredentialService,
 import {
   base64UrlDecodeUtf8,
   base64UrlEncode,
+  resolveSessionCookieName,
   signPayload,
   timingSafeEqualBase64Url,
 } from "../utils.ts";
 }
 export const makeSessionCredentialService = Effect.gen(function* () {
+  const serverConfig = yield* ServerConfig;
   const secretStore = yield* ServerSecretStore;
   const authSessions = yield* AuthSessionRepository;
   const signingSecret = yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME, 32);
   const connectedSessionsRef = yield* Ref.make(new Map<string, number>());
   const changesPubSub = yield* PubSub.unbounded<SessionCredentialChange>();
+  const cookieName = resolveSessionCookieName({
+    mode: serverConfig.mode,
+    port: serverConfig.port,
+  });
   const toSessionCredentialError = (message: string) => (cause: unknown) =>
     new SessionCredentialError({
     }).pipe(Effect.mapError(toSessionCredentialError("Failed to revoke other sessions.")));
   return {
-    cookieName: SESSION_COOKIE_NAME,
+    cookieName,
     issue,
     verify,
     issueWebSocketToken,

apps/server/src/auth/utils.ts+12−1

@@ -2,7 +2,18 @@ import type { AuthClientMetadata, AuthClientMetadataDeviceType } from "@t3tools/ · 1 unmodified line
2	import type * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";	2	import type * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
3	import * as Crypto from "node:crypto";	3	import * as Crypto from "node:crypto";
4		4
5	export const SESSION_COOKIE_NAME = "t3_session";	5	const SESSION_COOKIE_NAME = "t3_session";
		6
		7	export function resolveSessionCookieName(input: {
		8	readonly mode: "web" \| "desktop";
		9	readonly port: number;
		10	}): string {
		11	if (input.mode !== "desktop") {
		12	return SESSION_COOKIE_NAME;
		13	}
		14
		15	return `${SESSION_COOKIE_NAME}_${input.port}`;
		16	}
6		17
7	export function base64UrlEncode(input: string \| Uint8Array): string {	18	export function base64UrlEncode(input: string \| Uint8Array): string {
8	const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.from(input);	19	const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.from(input);

apps/server/src/server.test.ts+1−1

@@ -789,7 +789,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => { · 788 unmodified lines
789	"browser-session-cookie",	789	"browser-session-cookie",
790	"bearer-session-token",	790	"bearer-session-token",
791	]);	791	]);
792	assert.equal(body.auth.sessionCookieName, "t3_session");	792	assert.isTrue(body.auth.sessionCookieName.startsWith("t3_session_"));
793	}).pipe(Effect.provide(NodeHttpServer.layerTest)),	793	}).pipe(Effect.provide(NodeHttpServer.layerTest)),
794	);	794	);
795		795

Stabilize auth session cookies per server mode (#1898)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code