Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

Browse Source 
- consumeTransferToken now recomputes and constant-time compares the
  entry's HMAC-SHA256; previously the signature was minted but never
  checked, so the documented "防篡改" guarantee was hollow and security
  rested solely on the sync.Map key's randomness.
- CSRF switches from a raw-random double-submit cookie to a signed token
  (nonce.HMAC-SHA256 keyed by JWTSecretKey). The middleware now also
  validates the signature, defeating sibling-subdomain cookie tossing
  where a naive header==cookie pair would otherwise pass.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-31 05:48:50 +00:00
co-authored by cloudcode
parent d4837dfc7a
commit 05e14981b5
6 changed files with 280 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/csrf_test.go
+6 -3
View File
@@ -39,6 +39,7 @@ func TestCSRFMiddleware_AllowsSafeMethodsWithoutToken(t *testing.T) {
// POST — would 403 forever and force a manual re-login. GET carries no CSRF
// risk, so the middleware mints the cookie when it is absent.
func TestCSRFMiddleware_SeedsCookieOnSafeMethodWhenMissing(t *testing.T) {
withCSRFSecret(t, "test-jwt-secret")
mw := csrfMiddleware()
w := httptest.NewRecorder()
c, _ := gin.CreateTestContext(w)
@@ -90,6 +91,8 @@ func TestCSRFMiddleware_BlocksUnsafeMethodWithoutToken(t *testing.T) {
}
func TestCSRFMiddleware_AcceptsMatchingHeaderAndCookie(t *testing.T) {
withCSRFSecret(t, "test-jwt-secret")
token := issueCSRFToken()
mw := csrfMiddleware()
for _, m := range []string{"POST", "PATCH", "PUT", "DELETE"} {
t.Run(m, func(t *testing.T) {
@@ -97,11 +100,11 @@ func TestCSRFMiddleware_AcceptsMatchingHeaderAndCookie(t *testing.T) {
c, _ := gin.CreateTestContext(w)
c.Request = httptest.NewRequest(m, "/api/v1/profile", nil)
c.Request.AddCookie(&http.Cookie{Name: "nz-jwt", Value: "anything"})
c.Request.AddCookie(&http.Cookie{Name: "nz-csrf", Value: "matching-token"})
c.Request.Header.Set("X-CSRF-Token", "matching-token")
c.Request.AddCookie(&http.Cookie{Name: "nz-csrf", Value: token})
c.Request.Header.Set("X-CSRF-Token", token)
mw(c)
if c.IsAborted() {
t.Fatalf("%s with matching csrf header+cookie must pass", m)
t.Fatalf("%s with matching signed csrf header+cookie must pass", m)
}
})
}