2019-05-29 05:21:06 -04:00
|
|
|
const AuthenticationManager = require('./AuthenticationManager')
|
2020-08-19 05:11:32 -04:00
|
|
|
const OError = require('@overleaf/o-error')
|
2019-05-29 05:21:06 -04:00
|
|
|
const LoginRateLimiter = require('../Security/LoginRateLimiter')
|
|
|
|
const UserUpdater = require('../User/UserUpdater')
|
2020-10-30 04:10:50 -04:00
|
|
|
const Metrics = require('@overleaf/metrics')
|
2019-05-29 05:21:06 -04:00
|
|
|
const logger = require('logger-sharelatex')
|
|
|
|
const querystring = require('querystring')
|
|
|
|
const Settings = require('settings-sharelatex')
|
|
|
|
const basicAuth = require('basic-auth-connect')
|
2019-11-07 05:28:18 -05:00
|
|
|
const crypto = require('crypto')
|
2019-05-29 05:21:06 -04:00
|
|
|
const UserHandler = require('../User/UserHandler')
|
|
|
|
const UserSessionsManager = require('../User/UserSessionsManager')
|
2019-10-22 05:08:49 -04:00
|
|
|
const SessionStoreManager = require('../../infrastructure/SessionStoreManager')
|
2019-05-29 05:21:06 -04:00
|
|
|
const Analytics = require('../Analytics/AnalyticsManager')
|
|
|
|
const passport = require('passport')
|
|
|
|
const NotificationsBuilder = require('../Notifications/NotificationsBuilder')
|
2019-09-25 10:29:10 -04:00
|
|
|
const UrlHelper = require('../Helpers/UrlHelper')
|
2020-04-01 11:07:44 -04:00
|
|
|
const AsyncFormHelper = require('../Helpers/AsyncFormHelper')
|
2019-08-07 10:04:18 -04:00
|
|
|
const _ = require('lodash')
|
2020-07-27 06:46:27 -04:00
|
|
|
const {
|
|
|
|
acceptsJson
|
|
|
|
} = require('../../infrastructure/RequestContentTypeDetection')
|
|
|
|
|
|
|
|
function send401WithChallenge(res) {
|
|
|
|
res.setHeader('WWW-Authenticate', 'OverleafLogin')
|
|
|
|
res.sendStatus(401)
|
|
|
|
}
|
2019-05-29 05:21:06 -04:00
|
|
|
|
2020-08-13 09:42:28 -04:00
|
|
|
const AuthenticationController = {
|
2019-05-29 05:21:06 -04:00
|
|
|
serializeUser(user, callback) {
|
2019-08-07 10:04:18 -04:00
|
|
|
if (!user._id || !user.email) {
|
|
|
|
const err = new Error('serializeUser called with non-user object')
|
|
|
|
logger.warn({ user }, err.message)
|
|
|
|
return callback(err)
|
|
|
|
}
|
2019-05-29 05:21:06 -04:00
|
|
|
const lightUser = {
|
|
|
|
_id: user._id,
|
|
|
|
first_name: user.first_name,
|
|
|
|
last_name: user.last_name,
|
|
|
|
isAdmin: user.isAdmin,
|
|
|
|
staffAccess: user.staffAccess,
|
|
|
|
email: user.email,
|
|
|
|
referal_id: user.referal_id,
|
|
|
|
session_created: new Date().toISOString(),
|
|
|
|
ip_address: user._login_req_ip,
|
|
|
|
must_reconfirm: user.must_reconfirm,
|
|
|
|
v1_id: user.overleaf != null ? user.overleaf.id : undefined
|
|
|
|
}
|
2019-08-07 10:04:18 -04:00
|
|
|
callback(null, lightUser)
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
deserializeUser(user, cb) {
|
2019-08-07 10:04:18 -04:00
|
|
|
cb(null, user)
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
passportLogin(req, res, next) {
|
|
|
|
// This function is middleware which wraps the passport.authenticate middleware,
|
|
|
|
// so we can send back our custom `{message: {text: "", type: ""}}` responses on failure,
|
|
|
|
// and send a `{redir: ""}` response on success
|
2019-08-07 10:04:18 -04:00
|
|
|
passport.authenticate('local', function(err, user, info) {
|
|
|
|
if (err) {
|
2019-05-29 05:21:06 -04:00
|
|
|
return next(err)
|
|
|
|
}
|
|
|
|
if (user) {
|
|
|
|
// `user` is either a user object or false
|
|
|
|
return AuthenticationController.finishLogin(user, req, res, next)
|
|
|
|
} else {
|
|
|
|
if (info.redir != null) {
|
|
|
|
return res.json({ redir: info.redir })
|
|
|
|
} else {
|
|
|
|
return res.json({ message: info })
|
|
|
|
}
|
|
|
|
}
|
|
|
|
})(req, res, next)
|
|
|
|
},
|
|
|
|
|
|
|
|
finishLogin(user, req, res, next) {
|
|
|
|
if (user === false) {
|
|
|
|
return res.redirect('/login')
|
|
|
|
} // OAuth2 'state' mismatch
|
2020-04-01 11:06:46 -04:00
|
|
|
|
|
|
|
const Modules = require('../../infrastructure/Modules')
|
|
|
|
Modules.hooks.fire('preFinishLogin', req, res, user, function(
|
|
|
|
error,
|
|
|
|
results
|
|
|
|
) {
|
|
|
|
if (error) {
|
|
|
|
return next(error)
|
|
|
|
}
|
|
|
|
if (results.some(result => result && result.doNotFinish)) {
|
2020-04-22 05:56:46 -04:00
|
|
|
return
|
2020-04-01 11:06:46 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
if (user.must_reconfirm) {
|
|
|
|
return AuthenticationController._redirectToReconfirmPage(req, res, user)
|
2019-08-07 10:04:18 -04:00
|
|
|
}
|
2020-04-01 11:06:46 -04:00
|
|
|
|
|
|
|
const redir =
|
|
|
|
AuthenticationController._getRedirectFromSession(req) || '/project'
|
2020-04-28 09:12:05 -04:00
|
|
|
_loginAsyncHandlers(req, user)
|
|
|
|
_afterLoginSessionSetup(req, user, function(err) {
|
2019-08-07 10:04:18 -04:00
|
|
|
if (err) {
|
2020-04-01 11:06:46 -04:00
|
|
|
return next(err)
|
2019-08-07 10:04:18 -04:00
|
|
|
}
|
2020-10-06 09:49:50 -04:00
|
|
|
AuthenticationController._clearRedirectFromSession(req)
|
|
|
|
AsyncFormHelper.redirect(req, res, redir)
|
2019-08-07 10:04:18 -04:00
|
|
|
})
|
|
|
|
})
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
doPassportLogin(req, username, password, done) {
|
|
|
|
const email = username.toLowerCase()
|
|
|
|
const Modules = require('../../infrastructure/Modules')
|
2019-08-07 10:04:18 -04:00
|
|
|
Modules.hooks.fire('preDoPassportLogin', req, email, function(
|
2019-05-29 05:21:06 -04:00
|
|
|
err,
|
|
|
|
infoList
|
|
|
|
) {
|
2019-08-07 10:04:18 -04:00
|
|
|
if (err) {
|
2019-06-06 08:43:17 -04:00
|
|
|
return done(err)
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
const info = infoList.find(i => i != null)
|
|
|
|
if (info != null) {
|
|
|
|
return done(null, false, info)
|
|
|
|
}
|
2019-08-07 10:04:18 -04:00
|
|
|
LoginRateLimiter.processLoginRequest(email, function(err, isAllowed) {
|
|
|
|
if (err) {
|
2019-05-29 05:21:06 -04:00
|
|
|
return done(err)
|
|
|
|
}
|
|
|
|
if (!isAllowed) {
|
|
|
|
logger.log({ email }, 'too many login requests')
|
|
|
|
return done(null, null, {
|
|
|
|
text: req.i18n.translate('to_many_login_requests_2_mins'),
|
|
|
|
type: 'error'
|
|
|
|
})
|
|
|
|
}
|
2019-08-07 10:04:18 -04:00
|
|
|
AuthenticationManager.authenticate({ email }, password, function(
|
2019-05-29 05:21:06 -04:00
|
|
|
error,
|
|
|
|
user
|
|
|
|
) {
|
|
|
|
if (error != null) {
|
|
|
|
return done(error)
|
|
|
|
}
|
|
|
|
if (user != null) {
|
|
|
|
// async actions
|
2019-08-07 10:04:18 -04:00
|
|
|
done(null, user)
|
2019-05-29 05:21:06 -04:00
|
|
|
} else {
|
|
|
|
AuthenticationController._recordFailedLogin()
|
|
|
|
logger.log({ email }, 'failed log in')
|
2019-08-07 10:04:18 -04:00
|
|
|
done(null, false, {
|
2019-05-29 05:21:06 -04:00
|
|
|
text: req.i18n.translate('email_or_password_wrong_try_again'),
|
|
|
|
type: 'error'
|
|
|
|
})
|
|
|
|
}
|
|
|
|
})
|
|
|
|
})
|
|
|
|
})
|
|
|
|
},
|
|
|
|
|
|
|
|
ipMatchCheck(req, user) {
|
|
|
|
if (req.ip !== user.lastLoginIp) {
|
|
|
|
NotificationsBuilder.ipMatcherAffiliation(user._id).create(req.ip)
|
|
|
|
}
|
|
|
|
return UserUpdater.updateUser(user._id.toString(), {
|
|
|
|
$set: { lastLoginIp: req.ip }
|
|
|
|
})
|
|
|
|
},
|
|
|
|
|
|
|
|
setInSessionUser(req, props) {
|
2019-08-07 10:04:18 -04:00
|
|
|
const sessionUser = AuthenticationController.getSessionUser(req)
|
|
|
|
if (!sessionUser) {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
for (let key in props) {
|
|
|
|
const value = props[key]
|
|
|
|
sessionUser[key] = value
|
|
|
|
}
|
|
|
|
return null
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
isUserLoggedIn(req) {
|
2019-06-06 08:43:17 -04:00
|
|
|
const userId = AuthenticationController.getLoggedInUserId(req)
|
|
|
|
return ![null, undefined, false].includes(userId)
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
// TODO: perhaps should produce an error if the current user is not present
|
|
|
|
getLoggedInUserId(req) {
|
|
|
|
const user = AuthenticationController.getSessionUser(req)
|
|
|
|
if (user) {
|
|
|
|
return user._id
|
|
|
|
} else {
|
|
|
|
return null
|
|
|
|
}
|
|
|
|
},
|
|
|
|
|
|
|
|
getLoggedInUserV1Id(req) {
|
|
|
|
const user = AuthenticationController.getSessionUser(req)
|
|
|
|
if ((user != null ? user.v1_id : undefined) != null) {
|
|
|
|
return user.v1_id
|
|
|
|
} else {
|
|
|
|
return null
|
|
|
|
}
|
|
|
|
},
|
|
|
|
|
|
|
|
getSessionUser(req) {
|
2019-08-07 10:04:18 -04:00
|
|
|
const sessionUser = _.get(req, ['session', 'user'])
|
|
|
|
const sessionPassportUser = _.get(req, ['session', 'passport', 'user'])
|
|
|
|
return sessionUser || sessionPassportUser || null
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
requireLogin() {
|
|
|
|
const doRequest = function(req, res, next) {
|
|
|
|
if (next == null) {
|
2019-06-06 08:43:17 -04:00
|
|
|
next = function() {}
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
if (!AuthenticationController.isUserLoggedIn(req)) {
|
2020-07-27 06:46:27 -04:00
|
|
|
if (acceptsJson(req)) return send401WithChallenge(res)
|
2019-05-29 05:21:06 -04:00
|
|
|
return AuthenticationController._redirectToLoginOrRegisterPage(req, res)
|
|
|
|
} else {
|
|
|
|
req.user = AuthenticationController.getSessionUser(req)
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return doRequest
|
|
|
|
},
|
|
|
|
|
2019-06-06 17:14:16 -04:00
|
|
|
requireOauth() {
|
2019-05-29 05:21:06 -04:00
|
|
|
// require this here because module may not be included in some versions
|
|
|
|
const Oauth2Server = require('../../../../modules/oauth2-server/app/src/Oauth2Server')
|
|
|
|
return function(req, res, next) {
|
|
|
|
if (next == null) {
|
2019-06-06 08:43:17 -04:00
|
|
|
next = function() {}
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
const request = new Oauth2Server.Request(req)
|
|
|
|
const response = new Oauth2Server.Response(res)
|
|
|
|
return Oauth2Server.server.authenticate(request, response, {}, function(
|
|
|
|
err,
|
|
|
|
token
|
|
|
|
) {
|
2019-08-07 10:04:18 -04:00
|
|
|
if (err) {
|
2019-05-29 05:21:06 -04:00
|
|
|
// use a 401 status code for malformed header for git-bridge
|
|
|
|
if (
|
|
|
|
err.code === 400 &&
|
|
|
|
err.message === 'Invalid request: malformed authorization header'
|
|
|
|
) {
|
|
|
|
err.code = 401
|
|
|
|
}
|
|
|
|
// send all other errors
|
|
|
|
return res
|
|
|
|
.status(err.code)
|
|
|
|
.json({ error: err.name, error_description: err.message })
|
|
|
|
}
|
|
|
|
req.oauth = { access_token: token.accessToken }
|
|
|
|
req.oauth_token = token
|
|
|
|
req.oauth_user = token.user
|
|
|
|
return next()
|
|
|
|
})
|
|
|
|
}
|
|
|
|
},
|
|
|
|
|
2019-10-22 05:08:49 -04:00
|
|
|
validateUserSession: function() {
|
|
|
|
// Middleware to check that the user's session is still good on key actions,
|
|
|
|
// such as opening a a project. Could be used to check that session has not
|
|
|
|
// exceeded a maximum lifetime (req.session.session_created), or for session
|
|
|
|
// hijacking checks (e.g. change of ip address, req.session.ip_address). For
|
|
|
|
// now, just check that the session has been loaded from the session store
|
|
|
|
// correctly.
|
|
|
|
return function(req, res, next) {
|
|
|
|
// check that the session store is returning valid results
|
|
|
|
if (req.session && !SessionStoreManager.hasValidationToken(req)) {
|
|
|
|
// force user to update session
|
|
|
|
req.session.regenerate(() => {
|
|
|
|
// need to destroy the existing session and generate a new one
|
|
|
|
// otherwise they will already be logged in when they are redirected
|
|
|
|
// to the login page
|
2020-07-27 06:46:27 -04:00
|
|
|
if (acceptsJson(req)) return send401WithChallenge(res)
|
2019-10-22 05:08:49 -04:00
|
|
|
AuthenticationController._redirectToLoginOrRegisterPage(req, res)
|
|
|
|
})
|
|
|
|
} else {
|
|
|
|
next()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
},
|
|
|
|
|
2019-05-29 05:21:06 -04:00
|
|
|
_globalLoginWhitelist: [],
|
|
|
|
addEndpointToLoginWhitelist(endpoint) {
|
|
|
|
return AuthenticationController._globalLoginWhitelist.push(endpoint)
|
|
|
|
},
|
|
|
|
|
|
|
|
requireGlobalLogin(req, res, next) {
|
|
|
|
if (
|
2019-08-07 10:04:18 -04:00
|
|
|
AuthenticationController._globalLoginWhitelist.includes(
|
2019-05-29 05:21:06 -04:00
|
|
|
req._parsedUrl.pathname
|
|
|
|
)
|
|
|
|
) {
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
|
2020-12-16 05:37:00 -05:00
|
|
|
if (req.headers.authorization != null) {
|
2019-08-07 10:04:18 -04:00
|
|
|
AuthenticationController.httpAuth(req, res, next)
|
2019-05-29 05:21:06 -04:00
|
|
|
} else if (AuthenticationController.isUserLoggedIn(req)) {
|
2019-08-07 10:04:18 -04:00
|
|
|
next()
|
2019-05-29 05:21:06 -04:00
|
|
|
} else {
|
|
|
|
logger.log(
|
|
|
|
{ url: req.url },
|
|
|
|
'user trying to access endpoint not in global whitelist'
|
|
|
|
)
|
2020-07-27 06:46:27 -04:00
|
|
|
if (acceptsJson(req)) return send401WithChallenge(res)
|
2019-05-29 05:21:06 -04:00
|
|
|
AuthenticationController.setRedirectInSession(req)
|
2019-08-07 10:04:18 -04:00
|
|
|
res.redirect('/login')
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
},
|
|
|
|
|
2020-08-19 05:09:02 -04:00
|
|
|
validateAdmin(req, res, next) {
|
|
|
|
const adminDomains = Settings.adminDomains
|
|
|
|
if (
|
|
|
|
!adminDomains ||
|
|
|
|
!(Array.isArray(adminDomains) && adminDomains.length)
|
|
|
|
) {
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
const user = AuthenticationController.getSessionUser(req)
|
|
|
|
if (!(user && user.isAdmin)) {
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
const email = user.email
|
|
|
|
if (email == null) {
|
|
|
|
return next(
|
|
|
|
new OError('[ValidateAdmin] Admin user without email address', {
|
|
|
|
userId: user._id
|
|
|
|
})
|
|
|
|
)
|
|
|
|
}
|
|
|
|
if (!adminDomains.find(domain => email.endsWith(`@${domain}`))) {
|
|
|
|
return next(
|
|
|
|
new OError('[ValidateAdmin] Admin user with invalid email domain', {
|
|
|
|
email: email,
|
|
|
|
userId: user._id
|
|
|
|
})
|
|
|
|
)
|
|
|
|
}
|
|
|
|
return next()
|
|
|
|
},
|
|
|
|
|
2019-05-29 05:21:06 -04:00
|
|
|
httpAuth: basicAuth(function(user, pass) {
|
2019-11-07 05:28:18 -05:00
|
|
|
let expectedPassword = Settings.httpAuthUsers[user]
|
|
|
|
const isValid =
|
|
|
|
expectedPassword &&
|
|
|
|
expectedPassword.length === pass.length &&
|
|
|
|
crypto.timingSafeEqual(Buffer.from(expectedPassword), Buffer.from(pass))
|
2019-05-29 05:21:06 -04:00
|
|
|
if (!isValid) {
|
|
|
|
logger.err({ user, pass }, 'invalid login details')
|
|
|
|
}
|
|
|
|
return isValid
|
|
|
|
}),
|
|
|
|
|
|
|
|
setRedirectInSession(req, value) {
|
|
|
|
if (value == null) {
|
|
|
|
value =
|
|
|
|
Object.keys(req.query).length > 0
|
|
|
|
? `${req.path}?${querystring.stringify(req.query)}`
|
|
|
|
: `${req.path}`
|
|
|
|
}
|
|
|
|
if (
|
|
|
|
req.session != null &&
|
|
|
|
!/^\/(socket.io|js|stylesheets|img)\/.*$/.test(value) &&
|
|
|
|
!/^.*\.(png|jpeg|svg)$/.test(value)
|
|
|
|
) {
|
2019-09-25 10:29:10 -04:00
|
|
|
const safePath = UrlHelper.getSafeRedirectPath(value)
|
2019-05-29 05:21:06 -04:00
|
|
|
return (req.session.postLoginRedirect = safePath)
|
|
|
|
}
|
|
|
|
},
|
|
|
|
|
|
|
|
_redirectToLoginOrRegisterPage(req, res) {
|
|
|
|
if (
|
|
|
|
req.query.zipUrl != null ||
|
|
|
|
req.query.project_name != null ||
|
|
|
|
req.path === '/user/subscription/new'
|
|
|
|
) {
|
2019-08-07 10:04:18 -04:00
|
|
|
AuthenticationController._redirectToRegisterPage(req, res)
|
2019-05-29 05:21:06 -04:00
|
|
|
} else {
|
2019-08-07 10:04:18 -04:00
|
|
|
AuthenticationController._redirectToLoginPage(req, res)
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
},
|
|
|
|
|
|
|
|
_redirectToLoginPage(req, res) {
|
|
|
|
logger.log(
|
|
|
|
{ url: req.url },
|
|
|
|
'user not logged in so redirecting to login page'
|
|
|
|
)
|
|
|
|
AuthenticationController.setRedirectInSession(req)
|
|
|
|
const url = `/login?${querystring.stringify(req.query)}`
|
|
|
|
res.redirect(url)
|
2019-08-07 10:04:18 -04:00
|
|
|
Metrics.inc('security.login-redirect')
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
_redirectToReconfirmPage(req, res, user) {
|
|
|
|
logger.log(
|
|
|
|
{ url: req.url },
|
|
|
|
'user needs to reconfirm so redirecting to reconfirm page'
|
|
|
|
)
|
|
|
|
req.session.reconfirm_email = user != null ? user.email : undefined
|
|
|
|
const redir = '/user/reconfirm'
|
2020-04-01 11:07:44 -04:00
|
|
|
AsyncFormHelper.redirect(req, res, redir)
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
_redirectToRegisterPage(req, res) {
|
|
|
|
logger.log(
|
|
|
|
{ url: req.url },
|
|
|
|
'user not logged in so redirecting to register page'
|
|
|
|
)
|
|
|
|
AuthenticationController.setRedirectInSession(req)
|
|
|
|
const url = `/register?${querystring.stringify(req.query)}`
|
|
|
|
res.redirect(url)
|
2019-08-07 10:04:18 -04:00
|
|
|
Metrics.inc('security.login-redirect')
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
2019-06-06 08:43:17 -04:00
|
|
|
_recordSuccessfulLogin(userId, callback) {
|
2019-05-29 05:21:06 -04:00
|
|
|
if (callback == null) {
|
2019-06-06 08:43:17 -04:00
|
|
|
callback = function() {}
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
2019-08-07 10:04:18 -04:00
|
|
|
UserUpdater.updateUser(
|
2019-06-06 08:43:17 -04:00
|
|
|
userId.toString(),
|
2019-05-29 05:21:06 -04:00
|
|
|
{
|
|
|
|
$set: { lastLoggedIn: new Date() },
|
|
|
|
$inc: { loginCount: 1 }
|
|
|
|
},
|
|
|
|
function(error) {
|
|
|
|
if (error != null) {
|
|
|
|
callback(error)
|
|
|
|
}
|
|
|
|
Metrics.inc('user.login.success')
|
2019-08-07 10:04:18 -04:00
|
|
|
callback()
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
)
|
|
|
|
},
|
|
|
|
|
|
|
|
_recordFailedLogin(callback) {
|
|
|
|
Metrics.inc('user.login.failed')
|
2019-06-06 08:43:17 -04:00
|
|
|
if (callback) callback()
|
2019-05-29 05:21:06 -04:00
|
|
|
},
|
|
|
|
|
|
|
|
_getRedirectFromSession(req) {
|
|
|
|
let safePath
|
2019-08-07 10:04:18 -04:00
|
|
|
const value = _.get(req, ['session', 'postLoginRedirect'])
|
2019-05-29 05:21:06 -04:00
|
|
|
if (value) {
|
2019-09-25 10:29:10 -04:00
|
|
|
safePath = UrlHelper.getSafeRedirectPath(value)
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
return safePath || null
|
|
|
|
},
|
|
|
|
|
|
|
|
_clearRedirectFromSession(req) {
|
|
|
|
if (req.session != null) {
|
2019-08-07 10:04:18 -04:00
|
|
|
delete req.session.postLoginRedirect
|
2019-05-29 05:21:06 -04:00
|
|
|
}
|
|
|
|
}
|
2020-08-13 09:42:28 -04:00
|
|
|
}
|
2020-04-28 09:12:05 -04:00
|
|
|
|
|
|
|
function _afterLoginSessionSetup(req, user, callback) {
|
|
|
|
if (callback == null) {
|
|
|
|
callback = function() {}
|
|
|
|
}
|
|
|
|
req.login(user, function(err) {
|
|
|
|
if (err) {
|
2020-08-19 05:11:32 -04:00
|
|
|
OError.tag(err, 'error from req.login', {
|
|
|
|
user_id: user._id
|
|
|
|
})
|
2020-04-28 09:12:05 -04:00
|
|
|
return callback(err)
|
|
|
|
}
|
|
|
|
// Regenerate the session to get a new sessionID (cookie value) to
|
|
|
|
// protect against session fixation attacks
|
|
|
|
const oldSession = req.session
|
|
|
|
req.session.destroy(function(err) {
|
|
|
|
if (err) {
|
2020-08-19 05:11:32 -04:00
|
|
|
OError.tag(err, 'error when trying to destroy old session', {
|
|
|
|
user_id: user._id
|
|
|
|
})
|
2020-04-28 09:12:05 -04:00
|
|
|
return callback(err)
|
|
|
|
}
|
|
|
|
req.sessionStore.generate(req)
|
|
|
|
// Note: the validation token is not writable, so it does not get
|
|
|
|
// transferred to the new session below.
|
|
|
|
for (let key in oldSession) {
|
|
|
|
const value = oldSession[key]
|
|
|
|
if (key !== '__tmp') {
|
|
|
|
req.session[key] = value
|
|
|
|
}
|
|
|
|
}
|
|
|
|
req.session.save(function(err) {
|
|
|
|
if (err) {
|
2020-08-19 05:11:32 -04:00
|
|
|
OError.tag(err, 'error saving regenerated session after login', {
|
|
|
|
user_id: user._id
|
|
|
|
})
|
2020-04-28 09:12:05 -04:00
|
|
|
return callback(err)
|
|
|
|
}
|
|
|
|
UserSessionsManager.trackSession(user, req.sessionID, function() {})
|
|
|
|
callback(null)
|
|
|
|
})
|
|
|
|
})
|
|
|
|
})
|
|
|
|
}
|
|
|
|
function _loginAsyncHandlers(req, user) {
|
|
|
|
UserHandler.setupLoginData(user, err => {
|
|
|
|
if (err != null) {
|
|
|
|
logger.warn({ err }, 'error setting up login data')
|
|
|
|
}
|
|
|
|
})
|
|
|
|
LoginRateLimiter.recordSuccessfulLogin(user.email)
|
|
|
|
AuthenticationController._recordSuccessfulLogin(user._id)
|
|
|
|
AuthenticationController.ipMatchCheck(req, user)
|
|
|
|
Analytics.recordEvent(user._id, 'user-logged-in', { ip: req.ip })
|
|
|
|
Analytics.identifyUser(user._id, req.sessionID)
|
|
|
|
logger.log(
|
|
|
|
{ email: user.email, user_id: user._id.toString() },
|
|
|
|
'successful log in'
|
|
|
|
)
|
|
|
|
req.session.justLoggedIn = true
|
|
|
|
// capture the request ip for use when creating the session
|
|
|
|
return (user._login_req_ip = req.ip)
|
|
|
|
}
|
2020-08-13 09:42:28 -04:00
|
|
|
|
|
|
|
module.exports = AuthenticationController
|