phga
3 years ago
parent
91841ab3d3
commit
e32df47ca2
@ -0,0 +1,199 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
cryptorand "crypto/rand"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"go.mongodb.org/mongo-driver/bson"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
type Session struct {
|
||||
ID [32]byte `json:"id" bson:"id"`
|
||||
AuthToken [32]byte `json:"auth_token" bson:"auth_token"`
|
||||
Timestamp int64 `json:"timestamp" bson:"timestamp"`
|
||||
}
|
||||
|
||||
// ------------------------------- MIDDLEWARE ----------------------------------
|
||||
type ctxKey int
|
||||
|
||||
const currUserKey ctxKey = 0
|
||||
|
||||
// validateSession verifies that the client has a session that is still valid
|
||||
func validateSession(h http.HandlerFunc, role string) http.HandlerFunc {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
// Allow to access required files pre login
|
||||
if r.URL.Path == "/static/css/tt.css" ||
|
||||
r.URL.Path == "/static/js/helper.js" ||
|
||||
r.URL.Path == "/static/fonts/OpenSans-Regular.ttf" {
|
||||
h(w, r)
|
||||
return
|
||||
}
|
||||
|
||||
cookie, err := r.Cookie("SESSION")
|
||||
|
||||
if err == http.ErrNoCookie {
|
||||
// Redirect to /login
|
||||
w.Header().Set("Location", "/login?r="+r.URL.Path)
|
||||
w.WriteHeader(http.StatusFound)
|
||||
log.Println(err)
|
||||
return
|
||||
} else if err != nil {
|
||||
log.Fatal(err)
|
||||
return
|
||||
}
|
||||
|
||||
// TESTING: Show cookie content
|
||||
// log.Printf("%+v", *cookie)
|
||||
requestedUser := checkSession([]byte(cookie.Value))
|
||||
|
||||
if requestedUser == nil {
|
||||
unsetCookie(w)
|
||||
w.Header().Set("Location", "/login")
|
||||
w.WriteHeader(http.StatusFound)
|
||||
return
|
||||
}
|
||||
// Set new timestamp
|
||||
requestedUser.CurrSession.Timestamp = time.Now().UTC().UnixNano()
|
||||
// Save to database
|
||||
updateSession(requestedUser)
|
||||
|
||||
setEncryptedCookie(w, requestedUser)
|
||||
ctx := context.WithValue(r.Context(), currUserKey, *requestedUser)
|
||||
requestWithUser := r.WithContext(ctx)
|
||||
|
||||
// ORIGINAL HANDLER
|
||||
switch role {
|
||||
case "":
|
||||
h(w, requestWithUser)
|
||||
case "admin":
|
||||
if isAdmin(requestedUser) {
|
||||
h(w, requestWithUser)
|
||||
} else {
|
||||
w.Header().Set("Location", "/")
|
||||
w.WriteHeader(http.StatusFound)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func isAdmin(u *User) bool {
|
||||
if u.Role == "admin" {
|
||||
log.Println("IS ADMIN")
|
||||
return true
|
||||
} else {
|
||||
log.Println("IS NOT ADMIN")
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
func encryptSession(s Session) (es []byte) {
|
||||
js, err := json.Marshal(s)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
es, err = encrypt(js, encKey)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func setEncryptedCookie(w http.ResponseWriter, u *User) {
|
||||
cValue := encryptSession(u.CurrSession)
|
||||
cookie := &http.Cookie{
|
||||
Name: "SESSION",
|
||||
Value: string(cValue),
|
||||
MaxAge: int(6 * time.Hour / time.Second),
|
||||
Path: "/",
|
||||
HttpOnly: false,
|
||||
}
|
||||
http.SetCookie(w, cookie)
|
||||
}
|
||||
|
||||
func unsetCookie(w http.ResponseWriter) {
|
||||
cookie := &http.Cookie{
|
||||
Name: "SESSION",
|
||||
MaxAge: -69,
|
||||
Path: "/",
|
||||
}
|
||||
http.SetCookie(w, cookie)
|
||||
}
|
||||
|
||||
// checkCredentials compares the pw provided by the user to the hashed version
|
||||
// in the database and returns true for success and false otherwise
|
||||
func checkCredentials(u *User, pw string) bool {
|
||||
hashedPw := u.Pass
|
||||
err := bcrypt.CompareHashAndPassword([]byte(hashedPw), []byte(pw))
|
||||
if err != nil {
|
||||
log.Print(err)
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// checkSession compares the encrypted session string with the current Session
|
||||
// set for the user and returns true if they match
|
||||
func checkSession(receivedSession []byte) *User {
|
||||
// Test
|
||||
dec, err := decrypt(receivedSession, encKey)
|
||||
if err != nil {
|
||||
log.Println("Encryption key changed, deleting remaining cookies!")
|
||||
return nil
|
||||
}
|
||||
// log.Println(string(dec))
|
||||
decryptedSession := Session{}
|
||||
err = json.Unmarshal(dec, &decryptedSession)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
// There is no current user but a (mayb) valid session -> get user with session from db
|
||||
requestedUser, err := getUserBySession(&decryptedSession)
|
||||
if err != nil {
|
||||
log.Println("No user with that session found in db:", err)
|
||||
return nil
|
||||
}
|
||||
|
||||
// 6 hours ago
|
||||
maxSessionAge := time.Now().UTC().UnixNano() - int64(6*time.Hour)
|
||||
|
||||
// Check if session is still valid (Other values must match anyways)
|
||||
if requestedUser.CurrSession.Timestamp >= maxSessionAge {
|
||||
return requestedUser
|
||||
} else {
|
||||
log.Println("User logged out because Session is no longer valid")
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func updateSession(u *User) {
|
||||
filter := bson.D{{"uid", u.UID}}
|
||||
update := bson.D{{"$set", bson.D{{"curr_session", u.CurrSession}}}}
|
||||
res, err := colUsers.UpdateOne(mongoCtx, filter, update)
|
||||
if err != nil {
|
||||
log.Fatal(err, res)
|
||||
}
|
||||
}
|
||||
|
||||
func createSession() (s Session) {
|
||||
var sID, aToken [32]byte
|
||||
_, err := io.ReadFull(cryptorand.Reader, sID[:])
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
_, err = io.ReadFull(cryptorand.Reader, aToken[:])
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
// MAYB: Also hash the random number? Any advantages?
|
||||
// sID := sha256.Sum256(nonce)
|
||||
// aToken := sha256.Sum256(nonce)
|
||||
return Session{ID: sID, AuthToken: aToken, Timestamp: time.Now().UTC().UnixNano()}
|
||||
}
|
||||
@ -0,0 +1,116 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"log"
|
||||
|
||||
"go.mongodb.org/mongo-driver/bson"
|
||||
"go.mongodb.org/mongo-driver/bson/primitive"
|
||||
"go.mongodb.org/mongo-driver/mongo"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
// User of the experiment
|
||||
type User struct {
|
||||
ID primitive.ObjectID `bson:"_id"`
|
||||
UID string `bson:"uid"`
|
||||
Mail string `bson: mail`
|
||||
Pass string `bson:"pass"`
|
||||
CurrSession Session `bson:"curr_session"`
|
||||
Role string `bson:"role"`
|
||||
}
|
||||
|
||||
func init() {
|
||||
createUser(config.WebAdmin, "", config.WebAdminPass, "admin")
|
||||
}
|
||||
|
||||
// createUser creates a new participant and writes it to the database.
|
||||
func createUser(uid string, email string, pass string, role string) *User {
|
||||
_, err := getUserByUID(uid)
|
||||
if err != mongo.ErrNoDocuments {
|
||||
log.Println("User with that UID already exists")
|
||||
return nil
|
||||
}
|
||||
if len(email) > 0 {
|
||||
_, err = getUserByEmail(email)
|
||||
if err != mongo.ErrNoDocuments {
|
||||
log.Println("User with that email already exists")
|
||||
return nil
|
||||
}
|
||||
}
|
||||
// salt+hash password to store in DB
|
||||
hashedPw, err := bcrypt.GenerateFromPassword([]byte(pass), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
log.Fatal("Error while creating a new User: ", err)
|
||||
}
|
||||
u := &User{
|
||||
ID: primitive.NewObjectID(),
|
||||
UID: uid,
|
||||
Mail: email,
|
||||
Pass: string(hashedPw),
|
||||
Role: role,
|
||||
}
|
||||
_, err = colUsers.InsertOne(mongoCtx, u)
|
||||
if err != nil {
|
||||
log.Fatal("Error while saving new user to DB: ", err)
|
||||
}
|
||||
return u
|
||||
}
|
||||
|
||||
// generateUserID generates a unique ID for each participant
|
||||
func generateUserID() (uid string) {
|
||||
for {
|
||||
uid = generateRandomString(5, "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890")
|
||||
// Check if ID is already in use
|
||||
err := colUsers.FindOne(mongoCtx, bson.M{"uid": uid}).Decode(bson.M{})
|
||||
// If not in use stop loop
|
||||
if err == mongo.ErrNoDocuments {
|
||||
break
|
||||
} else {
|
||||
// Log other errors
|
||||
log.Fatal(err)
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// getUserByUID returns a user with the same UID as uid from the DB
|
||||
func getUserByUID(uid string) (p *User, err error) {
|
||||
p = &User{}
|
||||
err = colUsers.FindOne(mongoCtx, bson.M{"uid": uid}).Decode(p)
|
||||
if err == mongo.ErrNoDocuments {
|
||||
return nil, err
|
||||
} else if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
return p, nil
|
||||
}
|
||||
|
||||
// getUserByEmail returns a user with the same email as email from the DB
|
||||
func getUserByEmail(email string) (p *User, err error) {
|
||||
p = &User{}
|
||||
err = colUsers.FindOne(mongoCtx, bson.M{"mail": email}).Decode(p)
|
||||
if err == mongo.ErrNoDocuments {
|
||||
return nil, err
|
||||
} else if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
return p, nil
|
||||
}
|
||||
|
||||
// getUserBySession returns a user with the same session as session from the DB
|
||||
func getUserBySession(s *Session) (p *User, err error) {
|
||||
p = &User{}
|
||||
|
||||
// Get only id and authtoken otherwise timestamp might be already overwritten
|
||||
err = colUsers.FindOne(mongoCtx, bson.M{
|
||||
"curr_session.id": s.ID,
|
||||
"curr_session.auth_token": s.AuthToken,
|
||||
}).Decode(p)
|
||||
if err == mongo.ErrNoDocuments {
|
||||
return nil, err
|
||||
} else if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
return p, nil
|
||||
}
|
||||
@ -1,4 +1,9 @@
|
||||
{{define "header"}}
|
||||
<header>
|
||||
<nav>
|
||||
<a href="/">home</a>
|
||||
<a href="/admin_panel">admin</a>
|
||||
<a href="/logout">logout</a>
|
||||
</nav>
|
||||
</header>
|
||||
{{end}}
|
||||
|
||||
@ -0,0 +1,44 @@
|
||||
{{define "body"}}
|
||||
<form id="frm-login" method="post" action="/login">
|
||||
<label for="inp-username">Participant ID:</label>
|
||||
<input id="inp-username" name="username" type="text" value=""/>
|
||||
<label for="inp-password">Password:</label>
|
||||
<input id="inp-password" name="password" type="password" value=""/>
|
||||
<input type="hidden" name="redirectTo" value="{{ .RedirectTo }}" />
|
||||
<button>Login</button>
|
||||
</form>
|
||||
<div class="hidden" id="general-info"></div>
|
||||
{{end}}
|
||||
{{define "scripts"}}
|
||||
<script>
|
||||
let frm = document.getElementById("frm-login");
|
||||
let infoBox = document.getElementById("general-info");
|
||||
|
||||
frm.addEventListener("submit", e => {
|
||||
e.preventDefault();
|
||||
let fd = new FormData(frm);
|
||||
fetch("/login", {
|
||||
method: "POST",
|
||||
body: new URLSearchParams({
|
||||
username: fd.get("username"),
|
||||
password: fd.get("password")
|
||||
}),
|
||||
headers: {
|
||||
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"
|
||||
}
|
||||
|
||||
}).then(res => {
|
||||
if (res.status == 200) {
|
||||
window.location = fd.get("redirectTo");
|
||||
} else {
|
||||
setInfo(infoBox, "Failure", "red", "grey1");
|
||||
toggleHidden(infoBox, "off");
|
||||
setTimeout(() => {
|
||||
toggleHidden(infoBox, "on");
|
||||
}, 2000);
|
||||
}
|
||||
})
|
||||
})
|
||||
</script>
|
||||
<script src="/static/js/helper.js"></script>
|
||||
{{end}}
|
||||
Loading…
Reference in new issue