Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-20 22:42:53 -05:00
Code Issues Activity

Used a base64 encoded string for hmac secret (#20269)

Browse source 
We want to use a randomly generated 64 byte secret for the hmac, and
utf8 encoding isn't nice to work with for this, so we're going to use a
base64 string and decode it into a buffer for the secret.
This commit is contained in:
Fabien 'egg' O'Carroll 2024-05-28 14:12:48 +07:00 • committed by GitHub
parent 5c5ec9da9f
commit 6a8ae57a24
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ghost/core/core/server/services/members/middleware.js
View file

@ -47,12 +47,16 @@ const setAccessCookies = function setAccessCookies(member = undefined, res, free
if (!hmacSecret) {
return;
}
const hmacSecretBuffer = Buffer.from(hmacSecret, 'base64');
if (hmacSecretBuffer.length === 0) {
return;
}
const activeSubscription = member.subscriptions?.find(sub => sub.status === 'active');
const cookieTimestamp = Math.floor(Date.now() / 1000); // to mitigate a cookie replay attack
const memberTier = activeSubscription && activeSubscription.tier.id || freeTier.id;
const memberTierAndTimestamp = `${memberTier}:${cookieTimestamp}`;
const memberTierHmac = crypto.createHmac('sha256', hmacSecret).update(memberTierAndTimestamp).digest('hex');
const memberTierHmac = crypto.createHmac('sha256', hmacSecretBuffer).update(memberTierAndTimestamp).digest('hex');
const maxAge = 3600;
const accessCookie = `ghost-access=${memberTierAndTimestamp}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict;`;

3
ghost/core/test/e2e-api/members/middleware.test.js
View file

@ -1,3 +1,4 @@
const crypto = require('crypto');
const {agentProvider, mockManager, fixtureManager, matchers, configUtils} = require('../../utils/e2e-framework');
const {anyEtag, anyObjectId, anyUuid, anyISODateTime, stringMatching} = matchers;
const models = require('../../../core/server/models');
@ -228,7 +229,7 @@ describe('Comments API', function () {
describe('when caching members content is enabled', function () {
it('sets ghost-access and ghost-access-hmac cookies', async function () {
configUtils.set('cacheMembersContent:enabled', true);
configUtils.set('cacheMembersContent:hmacSecret', 'testsecret');
configUtils.set('cacheMembersContent:hmacSecret', crypto.randomBytes(64).toString('base64'));
membersAgent = await agentProvider.getMembersAPIAgent();
await fixtureManager.init('newsletters', 'members:newsletters');
await membersAgent.loginAs('member@example.com');