Skip to content
This repository was archived by the owner on May 28, 2023. It is now read-only.

Commit d086c88

Browse files
pkarwpkarw
committed
Fix for auth/refreshToken encoding
1 parent 5e43687 commit d086c88

File tree

3 files changed

+55
-16
lines changed

3 files changed

+55
-16
lines changed

‎src/api/user.js‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import { apiStatus } from '../lib/util';
1+
import { apiStatus, encryptToken, decryptToken } from '../lib/util';
22
import { Router } from 'express';
33
import PlatformFactory from '../platform/factory';
44
import jwt from 'jwt-simple';
@@ -68,12 +68,12 @@ export default ({config, db}) => {
6868
*/
6969
if (config.usePriceTiers) {
7070
userProxy.me(result).then((resultMe) => {
71-
apiStatus(res, result, 200, {refreshToken: jwt.encode(req.body, config.authHashSecret ? config.authHashSecret : config.objHashSecret)});
71+
apiStatus(res, result, 200, {refreshToken: encryptToken(jwt.encode(req.body, config.authHashSecret ? config.authHashSecret : config.objHashSecret), config.authHashSecret ? config.authHashSecret : config.objHashSecret)});
7272
}).catch(err => {
7373
apiStatus(res, err, 500);
7474
})
7575
} else {
76-
apiStatus(res, result, 200, {refreshToken: jwt.encode(req.body, config.authHashSecret ? config.authHashSecret : config.objHashSecret)});
76+
apiStatus(res, result, 200, {refreshToken: encryptToken(jwt.encode(req.body, config.authHashSecret ? config.authHashSecret : config.objHashSecret), config.authHashSecret ? config.authHashSecret : config.objHashSecret)});
7777
}
7878
}).catch(err => {
7979
apiStatus(res, err, 500);
@@ -89,13 +89,16 @@ export default ({config, db}) => {
8989
if (!req.body || !req.body.refreshToken) {
9090
return apiStatus(res, 'No refresh token provided', 500);
9191
}
92-
93-
const decodedToken = jwt.decode(req.body ? req.body.refreshToken : '', config.authHashSecret ? config.authHashSecret : config.objHashSecret)
94-
if (!decodedToken) {
95-
return apiStatus(res, 'Invalid refresh token provided', 500);
92+
try {
93+
const decodedToken = jwt.decode(req.body ? decryptToken(req.body.refreshToken, config.authHashSecret ? config.authHashSecret : config.objHashSecret) : '', config.authHashSecret ? config.authHashSecret : config.objHashSecret)
94+
if (!decodedToken) {
95+
return apiStatus(res, 'Invalid refresh token provided', 500);
96+
}
97+
} catch (err) {
98+
return apiStatus(res, err.message, 500);
9699
}
97100
userProxy.login(decodedToken).then((result) => {
98-
apiStatus(res, result, 200, {refreshToken: jwt.encode(decodedToken, config.authHashSecret ? config.authHashSecret : config.objHashSecret)});
101+
apiStatus(res, result, 200, {refreshToken: encryptToken(jwt.encode(decodedToken, config.authHashSecret ? config.authHashSecret : config.objHashSecret), config.authHashSecret ? config.authHashSecret : config.objHashSecret)});
99102
}).catch(err => {
100103
apiStatus(res, err, 500);
101104
})

‎src/lib/util.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
import config from 'config';
2+
import crypto from 'crypto';
3+
const algorithm = 'aes-256-ctr';
4+
25
/** Creates a callback that proxies node callback style arguments to an Express Response object.
36
* @param {express.Response} res Express HTTP Response
47
* @param {number} [status=200] Status code to send on success
@@ -42,3 +45,17 @@ export function apiStatus(res, result = 'OK', code = 200, meta = null) {
4245
res.status(code).json(apiResult);
4346
return result;
4447
}
48+
49+
export function encryptToken(textToken, secret) {
50+
const cipher = crypto.createCipher(algorithm, secret)
51+
let crypted = cipher.update(textToken, 'utf8', 'hex')
52+
crypted += cipher.final('hex');
53+
return crypted;
54+
}
55+
56+
export function decryptToken(textToken, secret) {
57+
const decipher = crypto.createDecipher(algorithm, secret)
58+
let dec = decipher.update(textToken, 'hex', 'utf8')
59+
dec += decipher.final('utf8');
60+
return dec;
61+
}

‎yarn.lock‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ ajv@^5.2.3, ajv@^5.3.0:
8484
fast-json-stable-stringify "^2.0.0"
8585
json-schema-traverse "^0.3.0"
8686

87-
ajv@^6.4.0, ajv@^6.5.5:
87+
ajv@^6.4.0:
8888
version "6.6.1"
8989
resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.6.1.tgz#6360f5ed0d80f232cc2b294c362d5dc2e538dd61"
9090
dependencies:
@@ -93,6 +93,15 @@ ajv@^6.4.0, ajv@^6.5.5:
9393
json-schema-traverse "^0.4.1"
9494
uri-js "^4.2.2"
9595

96+
ajv@^6.5.5:
97+
version "6.10.0"
98+
resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.10.0.tgz#90d0d54439da587cd7e843bfb7045f50bd22bdf1"
99+
dependencies:
100+
fast-deep-equal "^2.0.1"
101+
fast-json-stable-stringify "^2.0.0"
102+
json-schema-traverse "^0.4.1"
103+
uri-js "^4.2.2"
104+
96105
align-text@^0.1.1, align-text@^0.1.3:
97106
version "0.1.4"
98107
resolved "https://registry.yarnpkg.com/align-text/-/align-text-0.1.4.tgz#0cd90a561093f35d0a99256c22b7069433fad117"
@@ -282,7 +291,7 @@ async@^2.0.1, async@^2.5, async@^2.6:
282291

283292
async@~1.0.0:
284293
version "1.0.0"
285-
resolved "http://registry.npmjs.org/async/-/async-1.0.0.tgz#f8fc04ca3a13784ade9e1641af98578cfbd647a9"
294+
resolved "https://registry.yarnpkg.com/async/-/async-1.0.0.tgz#f8fc04ca3a13784ade9e1641af98578cfbd647a9"
286295

287296
asynckit@^0.4.0:
288297
version "0.4.0"
@@ -1357,7 +1366,7 @@ color@^3.1.0:
13571366

13581367
colors@1.0.x:
13591368
version "1.0.3"
1360-
resolved "http://registry.npmjs.org/colors/-/colors-1.0.3.tgz#0433f44d809680fdeb60ed260f1b0c262e82a40b"
1369+
resolved "https://registry.yarnpkg.com/colors/-/colors-1.0.3.tgz#0433f44d809680fdeb60ed260f1b0c262e82a40b"
13611370

13621371
combined-stream@^1.0.6, combined-stream@~1.0.6:
13631372
version "1.0.7"
@@ -3080,8 +3089,8 @@ magento2-rest-client@0.0.2:
30803089
winston "^2.2.0"
30813090

30823091
"magento2-rest-client@github:DivanteLtd/magento2-rest-client":
3083-
version "0.0.7"
3084-
resolved "https://codeload.github.com/DivanteLtd/magento2-rest-client/tar.gz/77b217ba140a1bc484697e1d141676b8b5c83933"
3092+
version "0.0.8"
3093+
resolved "https://codeload.github.com/DivanteLtd/magento2-rest-client/tar.gz/30a67752e65a8d02eac3c7caa1ace51ea2c5f815"
30853094
dependencies:
30863095
humps "^1.1.0"
30873096
oauth-1.0a "^1.0.1"
@@ -3181,7 +3190,17 @@ migrate@^1.6.2:
31813190
version "1.37.0"
31823191
resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.37.0.tgz#0b6a0ce6fdbe9576e25f1f2d2fde8830dc0ad0d8"
31833192

3184-
mime-types@^2.1.12, mime-types@^2.1.18, mime-types@~2.1.18, mime-types@~2.1.19:
3193+
mime-db@~1.38.0:
3194+
version "1.38.0"
3195+
resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.38.0.tgz#1a2aab16da9eb167b49c6e4df2d9c68d63d8e2ad"
3196+
3197+
mime-types@^2.1.12, mime-types@~2.1.19:
3198+
version "2.1.22"
3199+
resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.22.tgz#fe6b355a190926ab7698c9a0556a11199b2199bd"
3200+
dependencies:
3201+
mime-db "~1.38.0"
3202+
3203+
mime-types@^2.1.18, mime-types@~2.1.18:
31853204
version "2.1.21"
31863205
resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.21.tgz#28995aa1ecb770742fe6ae7e58f9181c744b3f96"
31873206
dependencies:
@@ -4648,8 +4667,8 @@ sprintf-js@~1.0.2:
46484667
resolved "http://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c"
46494668

46504669
sshpk@^1.7.0:
4651-
version "1.15.2"
4652-
resolved "https://registry.yarnpkg.com/sshpk/-/sshpk-1.15.2.tgz#c946d6bd9b1a39d0e8635763f5242d6ed6dcb629"
4670+
version "1.16.1"
4671+
resolved "https://registry.yarnpkg.com/sshpk/-/sshpk-1.16.1.tgz#fb661c0bef29b39db40769ee39fa70093d6f6877"
46534672
dependencies:
46544673
asn1 "~0.2.3"
46554674
assert-plus "^1.0.0"

0 commit comments

Comments
 (0)