mirror of
https://github.com/elyby/accounts.git
synced 2024-08-26 14:29:57 +05:30
Use libsodium to encrypt all data, related to OAuth2
This commit is contained in:
parent
642db2e045
commit
6fb32ec76d
@ -3,21 +3,13 @@ declare(strict_types=1);
|
||||
|
||||
namespace api\components\OAuth2;
|
||||
|
||||
use api\components\OAuth2\Grants\AuthCodeGrant;
|
||||
use api\components\OAuth2\Grants\RefreshTokenGrant;
|
||||
use api\components\OAuth2\Keys\EmptyKey;
|
||||
use DateInterval;
|
||||
use League\OAuth2\Server\AuthorizationServer;
|
||||
use League\OAuth2\Server\Grant;
|
||||
use yii\base\Component as BaseComponent;
|
||||
|
||||
class Component extends BaseComponent {
|
||||
|
||||
/**
|
||||
* @var string|\Defuse\Crypto\Key
|
||||
*/
|
||||
public $encryptionKey;
|
||||
|
||||
/**
|
||||
* @var AuthorizationServer
|
||||
*/
|
||||
@ -39,19 +31,21 @@ class Component extends BaseComponent {
|
||||
$accessTokensRepo,
|
||||
new Repositories\EmptyScopeRepository(),
|
||||
new EmptyKey(),
|
||||
$this->encryptionKey
|
||||
'', // omit key because we use our own encryption mechanism
|
||||
new ResponseTypes\BearerTokenResponse()
|
||||
);
|
||||
$authCodeGrant = new AuthCodeGrant($authCodesRepo, $refreshTokensRepo, new DateInterval('PT10M'));
|
||||
/** @noinspection PhpUnhandledExceptionInspection */
|
||||
$authCodeGrant = new Grants\AuthCodeGrant($authCodesRepo, $refreshTokensRepo, new DateInterval('PT10M'));
|
||||
$authCodeGrant->disableRequireCodeChallengeForPublicClients();
|
||||
$authServer->enableGrantType($authCodeGrant, $accessTokenTTL);
|
||||
$authCodeGrant->setScopeRepository($publicScopesRepo); // Change repository after enabling
|
||||
|
||||
$refreshTokenGrant = new RefreshTokenGrant($refreshTokensRepo);
|
||||
$refreshTokenGrant = new Grants\RefreshTokenGrant($refreshTokensRepo);
|
||||
$authServer->enableGrantType($refreshTokenGrant);
|
||||
$refreshTokenGrant->setScopeRepository($publicScopesRepo); // Change repository after enabling
|
||||
|
||||
// TODO: make these access tokens live longer
|
||||
$clientCredentialsGrant = new Grant\ClientCredentialsGrant();
|
||||
$clientCredentialsGrant = new Grants\ClientCredentialsGrant();
|
||||
$authServer->enableGrantType($clientCredentialsGrant, $accessTokenTTL);
|
||||
$clientCredentialsGrant->setScopeRepository($internalScopesRepo); // Change repository after enabling
|
||||
|
||||
|
26
api/components/OAuth2/CryptTrait.php
Normal file
26
api/components/OAuth2/CryptTrait.php
Normal file
@ -0,0 +1,26 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace api\components\OAuth2;
|
||||
|
||||
use Yii;
|
||||
|
||||
/**
|
||||
* This trait is intended to override the standard data encryption behavior
|
||||
* with the help of \Defuse\Crypto\Crypto class, because the resultant string
|
||||
* is much larger than the original one.
|
||||
*
|
||||
* The implementation under the hood relies on using libsodium library
|
||||
* that provides more compact result values.
|
||||
*/
|
||||
trait CryptTrait {
|
||||
|
||||
protected function encrypt($unencryptedData): string {
|
||||
return Yii::$app->tokens->encryptValue($unencryptedData);
|
||||
}
|
||||
|
||||
protected function decrypt($encryptedData): string {
|
||||
return Yii::$app->tokens->decryptValue($encryptedData);
|
||||
}
|
||||
|
||||
}
|
@ -3,12 +3,14 @@ declare(strict_types=1);
|
||||
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\CryptTrait;
|
||||
use api\components\OAuth2\Repositories\PublicScopeRepository;
|
||||
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
|
||||
use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
|
||||
use League\OAuth2\Server\Grant\AuthCodeGrant as BaseAuthCodeGrant;
|
||||
|
||||
class AuthCodeGrant extends BaseAuthCodeGrant {
|
||||
use CryptTrait;
|
||||
|
||||
protected function issueRefreshToken(AccessTokenEntityInterface $accessToken): ?RefreshTokenEntityInterface {
|
||||
foreach ($accessToken->getScopes() as $scope) {
|
||||
|
12
api/components/OAuth2/Grants/ClientCredentialsGrant.php
Normal file
12
api/components/OAuth2/Grants/ClientCredentialsGrant.php
Normal file
@ -0,0 +1,12 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\CryptTrait;
|
||||
use League\OAuth2\Server\Grant\ClientCredentialsGrant as BaseClientCredentialsGrant;
|
||||
|
||||
class ClientCredentialsGrant extends BaseClientCredentialsGrant {
|
||||
use CryptTrait;
|
||||
|
||||
}
|
@ -3,6 +3,7 @@ declare(strict_types=1);
|
||||
|
||||
namespace api\components\OAuth2\Grants;
|
||||
|
||||
use api\components\OAuth2\CryptTrait;
|
||||
use common\models\OauthSession;
|
||||
use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
|
||||
use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
|
||||
@ -12,6 +13,7 @@ use Psr\Http\Message\ServerRequestInterface;
|
||||
use Yii;
|
||||
|
||||
class RefreshTokenGrant extends BaseRefreshTokenGrant {
|
||||
use CryptTrait;
|
||||
|
||||
/**
|
||||
* Previously, refresh tokens were stored in Redis.
|
||||
|
12
api/components/OAuth2/ResponseTypes/BearerTokenResponse.php
Normal file
12
api/components/OAuth2/ResponseTypes/BearerTokenResponse.php
Normal file
@ -0,0 +1,12 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace api\components\OAuth2\ResponseTypes;
|
||||
|
||||
use api\components\OAuth2\CryptTrait;
|
||||
use League\OAuth2\Server\ResponseTypes\BearerTokenResponse as BaseBearerTokenResponse;
|
||||
|
||||
class BearerTokenResponse extends BaseBearerTokenResponse {
|
||||
use CryptTrait;
|
||||
|
||||
}
|
@ -94,14 +94,14 @@ class Component extends BaseComponent {
|
||||
public function encryptValue(string $rawValue): string {
|
||||
/** @noinspection PhpUnhandledExceptionInspection */
|
||||
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
|
||||
$cipher = base64_encode($nonce . sodium_crypto_secretbox($rawValue, $nonce, $this->encryptionKey));
|
||||
$cipher = $this->base64UrlEncode($nonce . sodium_crypto_secretbox($rawValue, $nonce, $this->encryptionKey));
|
||||
sodium_memzero($rawValue);
|
||||
|
||||
return $cipher;
|
||||
}
|
||||
|
||||
public function decryptValue(string $encryptedValue): string {
|
||||
$decoded = base64_decode($encryptedValue);
|
||||
$decoded = $this->base64UrlDecode($encryptedValue);
|
||||
Assert::true($decoded !== false, 'passed value has an invalid base64 encoding');
|
||||
Assert::true(mb_strlen($decoded, '8bit') >= (SODIUM_CRYPTO_SECRETBOX_NONCEBYTES + SODIUM_CRYPTO_SECRETBOX_MACBYTES));
|
||||
$nonce = mb_substr($decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '8bit');
|
||||
@ -137,4 +137,12 @@ class Component extends BaseComponent {
|
||||
return $value;
|
||||
}
|
||||
|
||||
private function base64UrlEncode(string $rawValue): string {
|
||||
return rtrim(strtr(base64_encode($rawValue), '+/', '-_'), '=');
|
||||
}
|
||||
|
||||
private function base64UrlDecode(string $encodedValue): string {
|
||||
return base64_decode(str_pad(strtr($encodedValue, '-_', '+/'), strlen($encodedValue) % 4, '=', STR_PAD_RIGHT));
|
||||
}
|
||||
|
||||
}
|
||||
|
@ -1,9 +1,6 @@
|
||||
<?php
|
||||
return [
|
||||
'components' => [
|
||||
'oauth' => [
|
||||
'encryptionKey' => 'mock-encryption-key',
|
||||
],
|
||||
'tokens' => [
|
||||
'hmacKey' => 'tests-secret-key',
|
||||
'privateKeyPath' => codecept_data_dir('certs/private.pem'),
|
||||
|
@ -13,7 +13,6 @@ return [
|
||||
],
|
||||
'oauth' => [
|
||||
'class' => api\components\OAuth2\Component::class,
|
||||
'encryptionKey' => getenv('JWT_ENCRYPTION_KEY'),
|
||||
],
|
||||
'tokens' => [
|
||||
'class' => api\components\Tokens\Component::class,
|
||||
|
@ -18,7 +18,7 @@ class OauthSteps extends FunctionalTester {
|
||||
]), ['accept' => true]);
|
||||
$this->canSeeResponseJsonMatchesJsonPath('$.redirectUri');
|
||||
[$redirectUri] = $this->grabDataFromResponseByJsonPath('$.redirectUri');
|
||||
preg_match('/code=([\w-]+)/', $redirectUri, $matches);
|
||||
preg_match('/code=([^&$]+)/', $redirectUri, $matches);
|
||||
|
||||
return $matches[1];
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user