faas/bouncer.js

var API = require('./api')

var crypto = require('crypto')


var getSignedCookieRaw = function(req, cookieName) {
  var signedCookieRaw = null

  var rawCookies = req.headers.cookie
  if (rawCookies) {
    // Cookies key/val pairs are separted by ;
    var split1 = rawCookies.split(';')

    for (var i=0; i<split1.length; i++) {
      // Look for the cookie with the input cookieName
      if (split1[i].indexOf(cookieName) > -1) {
        // key/val pairs are separated by =
        var split2 = split1[i].split('=')
        //The cookie's value is 2nd index of the split array
        signedCookieRaw = split2[1]
      }
    }
  }

  return signedCookieRaw
}

var extractFaasCookieObj = function(faas_cookie_signed) {
  var method_name = "faas.io: extractFaasCookieObj";

  if (faas_cookie_signed) {
    //console.log(method_name+": faas_cookie_signed: "+faas_cookie_signed);

    try
    {
      faas_cookie_signed = decodeURIComponent(faas_cookie_signed);
    }
    catch (err) {
      //console.log(method_name+": error decoding faas_cookie_signed");
      return null;
    }
    //console.log(method_name+": decoded faas_cookie_signed: "+faas_cookie_signed);

    if (faas_cookie_signed) {
      // Signed Cookie Format (node.js Connect):
      // "s:" + {key: val, faas_session_id: xxxxxxxxxx} + "." + signature

      var split1 = (faas_cookie_signed.split('s:'))[1];
      //console.log("split1: "+split1);

      var faas_cookie_object_str = (split1.split('}.'))[0] + "}";
      //console.log("faas_cookie_object_str: "+faas_cookie_object_str);

      return JSON.parse(faas_cookie_object_str);
    } else {
      return null;
    }
  } else {
    return null;
  }
}

var _cookieSharedSecretCache = {}

var getCookieSharedSecret = function(api_key){
  return _cookieSharedSecretCache[api_key];
}

var setCookieSharedSecret = function(api_key, cookieSharedSecret){
  _cookieSharedSecretCache[api_key] = cookieSharedSecret;
  console.log('_cookieSharedSecretCache: ', _cookieSharedSecretCache);
}

var getCookieSharedSecretFromServer = function(requestedApiKey, cb) {
  var urlOpts = {
    pathname: '/bouncer/getCookieSharedSecret'
  , query: { 'requestedApiKey': requestedApiKey }
  }
  API.api({ url: urlOpts }, function(err, data){
    cb(err, data && data.cookie_shared_secret)
  })
}

exports.validateFaasSecurity = function(req, cb_err_obj){
  // First check if the mode is Shared Secret.
  // In that case, the signed cookies would have been decrypted
  // by CookieParser successfully
  var cookieRaw = getSignedCookieRaw(req, 'faas_cookie') // this has Signature suffix, and is URI encoded
  var cookieObj = extractFaasCookieObj(cookieRaw) // remove signature suffix, and construct JSON object

  if (!cookieRaw || !cookieObj) { cb_err_obj('No cookie'); return }

  var cookieObjStr = JSON.stringify(cookieObj)
  var connectSignedCookie = req.signedCookies['faas_cookie']

  if (cookieObjStr === connectSignedCookie) {
    // Things look good, the cookies were signed with a Shared Secret
    cb_err_obj(null, cookieObj)
  }
  else {
    if (cookieObj && cookieObj.api_key) {
      if (getCookieSharedSecret(cookieObj.api_key)) {
        // We already have the signing secret, so just validate the signature.
        validateFaasCookieLocal(cookieObj.api_key, cookieRaw, cb_err_obj)
      } else {
        // Cached secret not found. Get Cookie Shared Secret
        getCookieSharedSecretFromServer(cookieObj.api_key, function(err, cookieSharedSecret){
          if (err) {
            cb_err_obj(err)
          }
          else {
            // Set the cache.
            setCookieSharedSecret(cookieObj.api_key, cookieSharedSecret);
            // Validate.
            validateFaasCookieLocal(cookieObj.api_key, cookieRaw, cb_err_obj);
          }
        })
      }
    } else {
      cb_err_obj('no cookie')
    }
  }
}


///////////////////////////////////////////////////////////////////////////////////
// Locally validate signed cookie using the Cookie Secret from faas.io
///////////////////////////////////////////////////////////////////////////////////

//connect/lib/middleware/cookieSession.js -- cookieSession()
var getSignedCookie = function(api_key, val) {
  faasSignedCookie = 's:' + sign(val, getCookieSharedSecret(api_key))
  return faasSignedCookie
}

//cookie-signature/index.js
var sign = function(val, secret){
  if ('string' != typeof val) throw new TypeError('cookie required');
  if ('string' != typeof secret) throw new TypeError('secret required');
  return val + '.' + crypto
    .createHmac('sha256', secret)
    .update(val)
    .digest('base64')
    .replace(/\=+$/, '');
};


var validateFaasCookieLocal = function(api_key, signedCookie, cb_err_obj){

  // Get the clear text portion of the signed cookie
  var cookieObj = extractFaasCookieObj(signedCookie)
  var cookieObjStr = JSON.stringify(cookieObj)
  var signedCookieDecoded = decodeURIComponent(signedCookie)

  // Sign the clear cookie with the secret key again.
  var signTest = getSignedCookie(api_key, cookieObjStr)

  // Match the signatures
  if (signedCookieDecoded === signTest) {
    cb_err_obj(null, cookieObj)
  }
  else {
    cb_err_obj('invalid signature')
  }
}
////////////////////////////////////////////////////////////////////////////////
// END: Locally validate signed cookie using the Cookie Secret from faas.io
////////////////////////////////////////////////////////////////////////////////