feat: provide unique session id for each generaed session jwt

AdminForth/1900/image

Author: yaroslav8765

adminforth/auth.ts

@@ -86,20 +86,22 @@ class AdminForthAuth implements IAdminForthAuth {
     response.setHeader('Set-Cookie', `adminforth_${brandSlug}_jwt=; Path=${this.adminforth.config.baseUrl || '/'}; HttpOnly; SameSite=Strict; Expires=Thu, 01 Jan 1970 00:00:00 GMT`);
   }
 
-  setAuthCookie({ expireInDuration, response, username, pk}: {
+  setAuthCookie({ expireInDuration, response, username, pk, sessionId = crypto.randomUUID()}: {
     expireInDuration?: string,
     response: any, 
     username: string, 
-    pk: string | null
-  }) {
+    pk: string | null,
+    sessionId?: string
+  }): string {
     const expiresIn: string = expireInDuration || (process.env.ADMINFORTH_AUTH_EXPIRESIN || '24h');
     // might be h,m,d in string
     const expiresInSec = parseTimeToSeconds(expiresIn);
 
-    const token = this.issueJWT({ username, pk}, 'auth', expiresInSec);
+    const token = this.issueJWT({ username, pk, sessionId }, 'auth', expiresInSec);
     const expiresCookieFormat = new Date(Date.now() + expiresInSec * 1000).toUTCString();
     const brandSlug = this.adminforth.config.customization.brandNameSlug;
     response.setHeader('Set-Cookie', `adminforth_${brandSlug}_jwt=${token}; Path=${this.adminforth.config.baseUrl || '/'}; HttpOnly; SameSite=Strict; Expires=${expiresCookieFormat}`);
+    return sessionId;
   }
 
   removeCustomCookie({response, name}) {

adminforth/documentation/docs/tutorial/03-Customization/12-security.md

@@ -340,7 +340,7 @@ export const admin = new AdminForth({
   auth: {
     beforeLogout: [
       async ({ adminUser, adminforth, extra }) => {
-        await revokeExternalSession(adminUser.pk);
+        await revokeExternalSession(adminUser.sessionId);
       }
     ]
   }

adminforth/types/Back.ts

@@ -563,7 +563,11 @@ export interface IAdminForthAuth {
 
   getCustomCookie({cookies, name}: {cookies: {key: string, value: string}[], name: string}): string | null;
 
-  setAuthCookie({expireInDuration, response, username, pk,}: {expireInDuration?: string, response: any, username: string, pk: string}): void;
+  /**
+   * Issues auth jwt and sets it as auth cookie. Returns session id which is put into the token,
+   * generated one if `sessionId` was not passed.
+   */
+  setAuthCookie({expireInDuration, response, username, pk, sessionId}: {expireInDuration?: string, response: any, username: string, pk: string, sessionId?: string}): string;
 
   removeAuthCookie(response: any): void;
 

adminforth/types/Common.ts

@@ -105,6 +105,16 @@ export interface AdminUser {
    */
   dbUser: any,
 
+  /**
+   * Unique id of login session, generated when auth cookie is issued and stored in auth JWT.
+   * Same for all requests done with one login, changes on next login.
+   * Use it to track or revoke individual sessions, e.g. in {@link AdminForthConfig.auth.beforeLogout} hook.
+   *
+   * Not defined for sessions which were issued before session ids were introduced, and for
+   * external users ({@link AdminUser.isExternalUser}).
+   */
+  sessionId?: string,
+
   /**
    * Optional software actor executing an action on behalf of this user.
    * For example, `af-agent` or `codex@1.2.3 | Production Codex`.

tests/jest_tests/logout_hook.test.ts

@@ -15,6 +15,9 @@ const loginCookie = async (): Promise<string> => {
   return res.headers['set-cookie'][0].split(';')[0];
 };
 
+const sessionIdOf = (cookie: string) =>
+  JSON.parse(Buffer.from(cookie.split('.')[1], 'base64url').toString()).sessionId;
+
 afterAll(async () => {
   await closeApplication();
 });
@@ -44,6 +47,19 @@ describe('auth.beforeLogout', () => {
     expect(calls[0].translated).toEqual('Invalid username or password');
   });
 
+  it('receives session id of session being closed, so it can be revoked', async () => {
+    const seen: string[] = [];
+    hooks.push(async ({ adminUser }) => { seen.push(adminUser.sessionId); });
+
+    const firstCookie = await loginCookie();
+    const secondCookie = await loginCookie();
+    await logout(firstCookie);
+    await logout(secondCookie);
+
+    expect(seen).toEqual([sessionIdOf(firstCookie), sessionIdOf(secondCookie)]);
+    expect(seen[0]).not.toEqual(seen[1]);
+  });
+
   it('is called before auth cookie is removed and does not block logout', async () => {
     const called: string[] = [];
     hooks.push(

tests/jest_tests/session_id.test.ts

@@ -0,0 +1,62 @@
+import request from 'supertest';
+import { admin, app, closeApplication } from './authTestApp';
+
+type AuthorizeHook = (params: { adminUser: any }) => Promise<{ allowed?: boolean, error?: string }>;
+
+const authorizeHooks = admin.config.auth.adminUserAuthorize as AuthorizeHook[];
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+const login = async (): Promise<string> => {
+  const res = await request(app).post('/adminapi/v1/login').send({ username: 'adminforth', password: 'adminforth' });
+  return res.headers['set-cookie'][0].split(';')[0];
+};
+
+const tokenPayload = (cookie: string) =>
+  JSON.parse(Buffer.from(cookie.split('.')[1], 'base64url').toString());
+
+const checkAuth = (cookie: string) =>
+  request(app).post('/adminapi/v1/check_auth').set('Cookie', cookie).send({});
+
+afterAll(async () => {
+  await closeApplication();
+});
+
+afterEach(() => {
+  authorizeHooks.length = 0;
+});
+
+describe('auth session id', () => {
+  it('puts unique session id into auth token on every login', async () => {
+    const first = tokenPayload(await login());
+    const second = tokenPayload(await login());
+
+    expect(first.sessionId).toMatch(UUID_RE);
+    expect(second.sessionId).toMatch(UUID_RE);
+    expect(first.sessionId).not.toEqual(second.sessionId);
+  });
+
+  it('exposes same session id to every request done with one login', async () => {
+    const seen: string[] = [];
+    authorizeHooks.push(async ({ adminUser }) => { seen.push(adminUser.sessionId); return { allowed: true }; });
+
+    const cookie = await login();
+    await checkAuth(cookie);
+    await checkAuth(cookie);
+
+    expect(seen).toEqual([tokenPayload(cookie).sessionId, tokenPayload(cookie).sessionId]);
+  });
+
+  it('keeps sessions of parallel logins apart', async () => {
+    const seen: string[] = [];
+    authorizeHooks.push(async ({ adminUser }) => { seen.push(adminUser.sessionId); return { allowed: true }; });
+
+    const firstCookie = await login();
+    const secondCookie = await login();
+    await checkAuth(firstCookie);
+    await checkAuth(secondCookie);
+
+    expect(seen).toEqual([tokenPayload(firstCookie).sessionId, tokenPayload(secondCookie).sessionId]);
+    expect(seen[0]).not.toEqual(seen[1]);
+  });
+});