mirror of
https://github.com/volatiletech/authboss.git
synced 2025-01-22 05:09:42 +02:00
Fix issues from review
This commit is contained in:
Stephen Afam-Osemene
parent
6adbc5637a
commit
a8adfb4d47
14
authboss.go
14
authboss.go
@ -94,13 +94,21 @@ func (a *Authboss) UpdatePassword(ctx context.Context, user AuthableUser, newPas
|
||||
return rmStorer.DelRememberTokens(ctx, user.GetPID())
|
||||
}
|
||||
|
||||
// VerifyPassword check that the provided password for the user is correct.
|
||||
// Returns nil on success otherwise there will be an error.
|
||||
// Simply a wrapper for [a.Core.Hasher.CompareHashAndPassword]
|
||||
func (a *Authboss) VerifyPassword(user AuthableUser, password string) error {
|
||||
return a.Core.Hasher.CompareHashAndPassword(user.GetPassword(), password)
|
||||
}
|
||||
|
||||
// VerifyPassword uses authboss mechanisms to check that a password is correct.
|
||||
// Returns nil on success otherwise there will be an error. Simply a helper
|
||||
// to do the bcrypt comparison.
|
||||
//
|
||||
// NOTE: This function will work ONLY if no custom hasher was configured in global ab.config
|
||||
//
|
||||
// Deperecated: use [a.VerifyPassword] instead
|
||||
func VerifyPassword(user AuthableUser, password string) error {
|
||||
// TODO: function can be used ONLY if no custom hasher was configured in global ab.config
|
||||
// function should be either deprecated, or he we should have access to global ab's config
|
||||
// (also, we can't use defaults.NewBcryptHasher, because it will be cyclic dep)
|
||||
return bcrypt.CompareHashAndPassword([]byte(user.GetPassword()), []byte(password))
|
||||
}
|
||||
|
||||
|
||||
@ -3,15 +3,17 @@ package confirm
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/sha512"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"path"
|
||||
|
||||
"github.com/friendsofgo/errors"
|
||||
|
||||
"github.com/volatiletech/authboss/v3"
|
||||
)
|
||||
|
||||
@ -291,3 +293,29 @@ func Middleware(ab *authboss.Authboss) func(http.Handler) http.Handler {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// GenerateConfirmCreds generates pieces needed for user confirm
|
||||
// selector: hash of the first half of a 64 byte value
|
||||
// (to be stored in the database and used in SELECT query)
|
||||
// verifier: hash of the second half of a 64 byte value
|
||||
// (to be stored in database but never used in SELECT query)
|
||||
// token: the user-facing base64 encoded selector+verifier
|
||||
//
|
||||
// Deprecated: use [authboss.CredsGenerator] instead.
|
||||
func GenerateConfirmCreds() (selector, verifier, token string, err error) {
|
||||
confirmTokenSize := 64
|
||||
confirmTokenSplit := confirmTokenSize / 2
|
||||
|
||||
rawToken := make([]byte, confirmTokenSize)
|
||||
if _, err = io.ReadFull(rand.Reader, rawToken); err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
|
||||
selectorBytes := sha512.Sum512(rawToken[:confirmTokenSplit])
|
||||
verifierBytes := sha512.Sum512(rawToken[confirmTokenSplit:])
|
||||
|
||||
return base64.StdEncoding.EncodeToString(selectorBytes[:]),
|
||||
base64.StdEncoding.EncodeToString(verifierBytes[:]),
|
||||
base64.URLEncoding.EncodeToString(rawToken),
|
||||
nil
|
||||
}
|
||||
|
||||
2
go.mod
2
go.mod
@ -3,7 +3,6 @@ module github.com/volatiletech/authboss/v3
|
||||
go 1.19
|
||||
|
||||
require (
|
||||
github.com/alexedwards/argon2id v1.0.0
|
||||
github.com/friendsofgo/errors v0.9.2
|
||||
github.com/pquerna/otp v1.4.0
|
||||
golang.org/x/crypto v0.14.0
|
||||
@ -16,7 +15,6 @@ require (
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
golang.org/x/net v0.10.0 // indirect
|
||||
golang.org/x/sys v0.13.0 // indirect
|
||||
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/protobuf v1.29.0 // indirect
|
||||
|
||||
34
go.sum
34
go.sum
@ -1,7 +1,5 @@
|
||||
cloud.google.com/go v0.34.0 h1:eOI3/cP2VTU6uZLDYAoic+eyzzB9YyGmJ7eIjl8rOPg=
|
||||
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||
github.com/alexedwards/argon2id v1.0.0 h1:wJzDx66hqWX7siL/SRUmgz3F8YMrd/nfX/xHHcQQP0w=
|
||||
github.com/alexedwards/argon2id v1.0.0/go.mod h1:tYKkqIjzXvZdzPvADMWOEZ+l6+BD6CtBXMj5fnJppiw=
|
||||
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
|
||||
github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
|
||||
github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
|
||||
@ -23,50 +21,18 @@ github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
|
||||
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
|
||||
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||
golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
|
||||
golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
|
||||
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
|
||||
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
|
||||
|
||||
36
hasher.go
36
hasher.go
@ -1,20 +1,17 @@
|
||||
package authboss
|
||||
|
||||
import (
|
||||
"errors"
|
||||
|
||||
"github.com/alexedwards/argon2id"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
var ErrArgonMismatchedHashAndPassword = errors.New("hashedPassword is not the hash of the given password")
|
||||
|
||||
// Hasher is the interface that wraps the hashing and comparison of passwords
|
||||
type Hasher interface {
|
||||
CompareHashAndPassword(hash, password string) error
|
||||
GenerateHash(password string) (string, error)
|
||||
}
|
||||
|
||||
func NewBCryptHasher(cost int) Hasher {
|
||||
// NewBCryptHasher creates a new bcrypt hasher with the given cost
|
||||
func NewBCryptHasher(cost int) *bcryptHasher {
|
||||
return &bcryptHasher{cost: cost}
|
||||
}
|
||||
|
||||
@ -34,30 +31,3 @@ func (h *bcryptHasher) GenerateHash(password string) (string, error) {
|
||||
func (h *bcryptHasher) CompareHashAndPassword(hashedPassword, password string) error {
|
||||
return bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password))
|
||||
}
|
||||
|
||||
func NewArgon2Hasher(params *argon2id.Params) Hasher {
|
||||
if params == nil {
|
||||
params = argon2id.DefaultParams
|
||||
}
|
||||
return &argon2Hasher{params: *params}
|
||||
}
|
||||
|
||||
type argon2Hasher struct {
|
||||
params argon2id.Params
|
||||
}
|
||||
|
||||
func (h argon2Hasher) GenerateHash(password string) (string, error) {
|
||||
return argon2id.CreateHash(password, argon2id.DefaultParams)
|
||||
}
|
||||
|
||||
func (h *argon2Hasher) CompareHashAndPassword(hashedPassword, password string) error {
|
||||
matched, err := argon2id.ComparePasswordAndHash(password, hashedPassword)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !matched {
|
||||
return ErrArgonMismatchedHashAndPassword
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
@ -3,10 +3,13 @@ package recover
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/sha512"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"path"
|
||||
@ -335,3 +338,28 @@ func (r *Recover) mailURL(token string) string {
|
||||
p := path.Join(r.Config.Paths.Mount, "recover/end")
|
||||
return fmt.Sprintf("%s%s?%s", r.Config.Paths.RootURL, p, query.Encode())
|
||||
}
|
||||
|
||||
// GenerateRecoverCreds generates pieces needed for user recovery
|
||||
// selector: hash of the first half of a 64 byte value
|
||||
// (to be stored in the database and used in SELECT query)
|
||||
// verifier: hash of the second half of a 64 byte value
|
||||
// (to be stored in database but never used in SELECT query)
|
||||
// token: the user-facing base64 encoded selector+verifier
|
||||
//
|
||||
// Deprecated: Use authboss.CredsGenerator instead.
|
||||
func GenerateRecoverCreds() (selector, verifier, token string, err error) {
|
||||
recoverTokenSize := 64
|
||||
recoverTokenSplit := recoverTokenSize / 2
|
||||
|
||||
rawToken := make([]byte, recoverTokenSize)
|
||||
if _, err = io.ReadFull(rand.Reader, rawToken); err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
selectorBytes := sha512.Sum512(rawToken[:recoverTokenSplit])
|
||||
verifierBytes := sha512.Sum512(rawToken[recoverTokenSplit:])
|
||||
|
||||
return base64.StdEncoding.EncodeToString(selectorBytes[:]),
|
||||
base64.StdEncoding.EncodeToString(verifierBytes[:]),
|
||||
base64.URLEncoding.EncodeToString(rawToken),
|
||||
nil
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user