nodemailer/wildduck
1
1
Fork 0
mirror of https://github.com/nodemailer/wildduck.git synced 2024-09-20 15:26:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

do not allow to use same TOTP code

Browse source
This commit is contained in:
Andris Reinman 2019-08-22 21:47:36 +02:00
parent af3649159c
commit ecb74473a1
2 changed files with 35 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/consts.js
View file

@ -98,5 +98,7 @@ module.exports = {
// access token default ttl in seconds (token ttl time is extended every time token is used by this value) // access token default ttl in seconds (token ttl time is extended every time token is used by this value)
ACCESS_TOKEN_DEFAULT_TTL: 14 * 24 * 3600, ACCESS_TOKEN_DEFAULT_TTL: 14 * 24 * 3600,
// access token can be extended until max lifetime value is reached in seconds // access token can be extended until max lifetime value is reached in seconds
ACCESS_TOKEN_MAX_LIFETIME: 180 * 24 * 3600 ACCESS_TOKEN_MAX_LIFETIME: 180 * 24 * 3600,
TOTP_WINDOW_SIZE: 6
}; };

40
lib/user-handler.js
View file

@ -1732,7 +1732,7 @@ class UserHandler {
secret, secret,
encoding: 'base32', encoding: 'base32',
token: data.token, token: data.token,
window: 6 window: consts.TOTP_WINDOW_SIZE
}); });
if (!verified) { if (!verified) {
@ -1902,18 +1902,30 @@ class UserHandler {
} }
async checkTotp(user, data) { async checkTotp(user, data) {
let userRlKey = 'totp:' + user; let userRlKey = `totp:${user}`;
let totpSuccessKey = `totp:${user}:${data.token}`;
let rateLimitRes;
try { try {
rateLimitRes = await this.rateLimit(userRlKey, data, 0); let rateLimitRes = await this.rateLimit(userRlKey, data, 0);
if (!rateLimitRes.success) {
throw rateLimitResponse(rateLimitRes);
}
} catch (err) { } catch (err) {
err.code = 'InternalDatabaseError'; err.code = err.code || 'InternalDatabaseError';
throw err; throw err;
} }
if (!rateLimitRes.success) { try {
throw rateLimitResponse(rateLimitRes); let totpAlreadyUsed = await this.redis.exists(totpSuccessKey);
if (totpAlreadyUsed) {
let err = new Error('This code has already been used, please try again with a new code');
err.response = 'NO';
err.code = 'RateLimitedError';
throw err;
}
} catch (err) {
err.code = err.code || 'InternalDatabaseError';
throw err;
} }
let userData; let userData;
@ -1971,7 +1983,7 @@ class UserHandler {
secret, secret,
encoding: 'base32', encoding: 'base32',
token: data.token, token: data.token,
window: 6 window: consts.TOTP_WINDOW_SIZE
}); });
try { try {
@ -1995,6 +2007,18 @@ class UserHandler {
// ignore // ignore
} }
if (verified) {
try {
await this.redis
.multi()
.set(totpSuccessKey, Date.now())
.expire(totpSuccessKey, consts.TOTP_WINDOW_SIZE * 30)
.exec();
} catch (err) {
// ignore
}
}
return verified; return verified;
} }