From a8adfb4d47a112e4c0376708373e8fc8137e0add Mon Sep 17 00:00:00 2001 From: Stephen Afam-Osemene Date: Fri, 10 Nov 2023 22:49:33 +0000 Subject: [PATCH] Fix issues from review --- authboss.go | 14 +++++++++++--- confirm/confirm.go | 30 +++++++++++++++++++++++++++++- go.mod | 2 -- go.sum | 34 ---------------------------------- hasher.go | 36 +++--------------------------------- recover/recover.go | 28 ++++++++++++++++++++++++++++ 6 files changed, 71 insertions(+), 73 deletions(-) diff --git a/authboss.go b/authboss.go index efdfc44..1081914 100644 --- a/authboss.go +++ b/authboss.go @@ -94,13 +94,21 @@ func (a *Authboss) UpdatePassword(ctx context.Context, user AuthableUser, newPas return rmStorer.DelRememberTokens(ctx, user.GetPID()) } +// VerifyPassword check that the provided password for the user is correct. +// Returns nil on success otherwise there will be an error. +// Simply a wrapper for [a.Core.Hasher.CompareHashAndPassword] +func (a *Authboss) VerifyPassword(user AuthableUser, password string) error { + return a.Core.Hasher.CompareHashAndPassword(user.GetPassword(), password) +} + // VerifyPassword uses authboss mechanisms to check that a password is correct. // Returns nil on success otherwise there will be an error. Simply a helper // to do the bcrypt comparison. +// +// NOTE: This function will work ONLY if no custom hasher was configured in global ab.config +// +// Deperecated: use [a.VerifyPassword] instead func VerifyPassword(user AuthableUser, password string) error { - // TODO: function can be used ONLY if no custom hasher was configured in global ab.config - // function should be either deprecated, or he we should have access to global ab's config - // (also, we can't use defaults.NewBcryptHasher, because it will be cyclic dep) return bcrypt.CompareHashAndPassword([]byte(user.GetPassword()), []byte(password)) } diff --git a/confirm/confirm.go b/confirm/confirm.go index e3aa694..6a9ab79 100644 --- a/confirm/confirm.go +++ b/confirm/confirm.go @@ -3,15 +3,17 @@ package confirm import ( "context" + "crypto/rand" + "crypto/sha512" "crypto/subtle" "encoding/base64" "fmt" + "io" "net/http" "net/url" "path" "github.com/friendsofgo/errors" - "github.com/volatiletech/authboss/v3" ) @@ -291,3 +293,29 @@ func Middleware(ab *authboss.Authboss) func(http.Handler) http.Handler { }) } } + +// GenerateConfirmCreds generates pieces needed for user confirm +// selector: hash of the first half of a 64 byte value +// (to be stored in the database and used in SELECT query) +// verifier: hash of the second half of a 64 byte value +// (to be stored in database but never used in SELECT query) +// token: the user-facing base64 encoded selector+verifier +// +// Deprecated: use [authboss.CredsGenerator] instead. +func GenerateConfirmCreds() (selector, verifier, token string, err error) { + confirmTokenSize := 64 + confirmTokenSplit := confirmTokenSize / 2 + + rawToken := make([]byte, confirmTokenSize) + if _, err = io.ReadFull(rand.Reader, rawToken); err != nil { + return "", "", "", err + } + + selectorBytes := sha512.Sum512(rawToken[:confirmTokenSplit]) + verifierBytes := sha512.Sum512(rawToken[confirmTokenSplit:]) + + return base64.StdEncoding.EncodeToString(selectorBytes[:]), + base64.StdEncoding.EncodeToString(verifierBytes[:]), + base64.URLEncoding.EncodeToString(rawToken), + nil +} diff --git a/go.mod b/go.mod index 8d6a6fd..0b581f4 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,6 @@ module github.com/volatiletech/authboss/v3 go 1.19 require ( - github.com/alexedwards/argon2id v1.0.0 github.com/friendsofgo/errors v0.9.2 github.com/pquerna/otp v1.4.0 golang.org/x/crypto v0.14.0 @@ -16,7 +15,6 @@ require ( github.com/davecgh/go-spew v1.1.1 // indirect github.com/golang/protobuf v1.5.3 // indirect golang.org/x/net v0.10.0 // indirect - golang.org/x/sys v0.13.0 // indirect golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.29.0 // indirect diff --git a/go.sum b/go.sum index bfbdbd1..2f1a827 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,5 @@ cloud.google.com/go v0.34.0 h1:eOI3/cP2VTU6uZLDYAoic+eyzzB9YyGmJ7eIjl8rOPg= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -github.com/alexedwards/argon2id v1.0.0 h1:wJzDx66hqWX7siL/SRUmgz3F8YMrd/nfX/xHHcQQP0w= -github.com/alexedwards/argon2id v1.0.0/go.mod h1:tYKkqIjzXvZdzPvADMWOEZ+l6+BD6CtBXMj5fnJppiw= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs= github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= @@ -23,50 +21,18 @@ github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= -golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw= golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= -golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= -golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= -golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk= diff --git a/hasher.go b/hasher.go index 531b8d7..a24c670 100644 --- a/hasher.go +++ b/hasher.go @@ -1,20 +1,17 @@ package authboss import ( - "errors" - - "github.com/alexedwards/argon2id" "golang.org/x/crypto/bcrypt" ) -var ErrArgonMismatchedHashAndPassword = errors.New("hashedPassword is not the hash of the given password") - +// Hasher is the interface that wraps the hashing and comparison of passwords type Hasher interface { CompareHashAndPassword(hash, password string) error GenerateHash(password string) (string, error) } -func NewBCryptHasher(cost int) Hasher { +// NewBCryptHasher creates a new bcrypt hasher with the given cost +func NewBCryptHasher(cost int) *bcryptHasher { return &bcryptHasher{cost: cost} } @@ -34,30 +31,3 @@ func (h *bcryptHasher) GenerateHash(password string) (string, error) { func (h *bcryptHasher) CompareHashAndPassword(hashedPassword, password string) error { return bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password)) } - -func NewArgon2Hasher(params *argon2id.Params) Hasher { - if params == nil { - params = argon2id.DefaultParams - } - return &argon2Hasher{params: *params} -} - -type argon2Hasher struct { - params argon2id.Params -} - -func (h argon2Hasher) GenerateHash(password string) (string, error) { - return argon2id.CreateHash(password, argon2id.DefaultParams) -} - -func (h *argon2Hasher) CompareHashAndPassword(hashedPassword, password string) error { - matched, err := argon2id.ComparePasswordAndHash(password, hashedPassword) - if err != nil { - return err - } - if !matched { - return ErrArgonMismatchedHashAndPassword - } - - return nil -} diff --git a/recover/recover.go b/recover/recover.go index e7ec850..734d3b8 100644 --- a/recover/recover.go +++ b/recover/recover.go @@ -3,10 +3,13 @@ package recover import ( "context" + "crypto/rand" + "crypto/sha512" "crypto/subtle" "encoding/base64" "errors" "fmt" + "io" "net/http" "net/url" "path" @@ -335,3 +338,28 @@ func (r *Recover) mailURL(token string) string { p := path.Join(r.Config.Paths.Mount, "recover/end") return fmt.Sprintf("%s%s?%s", r.Config.Paths.RootURL, p, query.Encode()) } + +// GenerateRecoverCreds generates pieces needed for user recovery +// selector: hash of the first half of a 64 byte value +// (to be stored in the database and used in SELECT query) +// verifier: hash of the second half of a 64 byte value +// (to be stored in database but never used in SELECT query) +// token: the user-facing base64 encoded selector+verifier +// +// Deprecated: Use authboss.CredsGenerator instead. +func GenerateRecoverCreds() (selector, verifier, token string, err error) { + recoverTokenSize := 64 + recoverTokenSplit := recoverTokenSize / 2 + + rawToken := make([]byte, recoverTokenSize) + if _, err = io.ReadFull(rand.Reader, rawToken); err != nil { + return "", "", "", err + } + selectorBytes := sha512.Sum512(rawToken[:recoverTokenSplit]) + verifierBytes := sha512.Sum512(rawToken[recoverTokenSplit:]) + + return base64.StdEncoding.EncodeToString(selectorBytes[:]), + base64.StdEncoding.EncodeToString(verifierBytes[:]), + base64.URLEncoding.EncodeToString(rawToken), + nil +}