enricobuehler
bda5556d37
Remediates the two web-console residuals from the 2026-07-05 posture audit: - Brute-force throttle (loginThrottle.ts): per-IP exponential backoff after 5 free attempts, plus a global floor for spread-out floods, keyed on the socket peer IP (not spoofable X-Forwarded-For) with a size-capped map. The constant-time compare already stopped the timing leak; this bounds guess *volume* against a by-design LAN-exposed console. - Session seal key now derives from the high-entropy mgmt token instead of the low-entropy login password, so a captured cookie is no longer an offline password oracle. Falls back to the password only when no token is configured (dev/local). Rotating the token now invalidates sessions. - Replace the process-wide NODE_TLS_REJECT_UNAUTHORIZED=0 with per-request Bun TLS scoped to the loopback proxy hop; a non-loopback mgmt URL now verifies normally. Dropped the env var from the systemd unit, Steam Deck installer, Windows run scripts, env examples, and web README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
1.9 KiB
TypeScript
59 lines
1.9 KiB
TypeScript
// POST /_auth/login {password} — verify the shared password (constant-time), then seal an
|
|
// authenticated session cookie. Public (allowlisted in the gate) so an unauthenticated user
|
|
// can actually log in. Brute force is bounded by an in-memory per-IP throttle (loginThrottle):
|
|
// the constant-time compare stops a timing leak, the throttle stops guessing at volume.
|
|
import {
|
|
createError,
|
|
defineEventHandler,
|
|
getRequestIP,
|
|
readBody,
|
|
setResponseHeader,
|
|
useSession,
|
|
} from "h3";
|
|
import {
|
|
type SessionData,
|
|
sessionConfig,
|
|
timingSafeEqual,
|
|
uiPassword,
|
|
} from "../../util/auth";
|
|
import {
|
|
recordLoginFailure,
|
|
recordLoginSuccess,
|
|
throttleRetryAfterMs,
|
|
} from "../../util/loginThrottle";
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const expected = uiPassword();
|
|
if (!expected) {
|
|
throw createError({
|
|
statusCode: 503,
|
|
statusMessage: "auth not configured",
|
|
});
|
|
}
|
|
// The socket peer address — deliberately NOT trusting X-Forwarded-For (spoofable unless we sit
|
|
// behind a known proxy, which the packaged console does not). Falls back to a single shared bucket
|
|
// if the address is somehow unavailable, so the throttle still applies.
|
|
const ip = getRequestIP(event) ?? "unknown";
|
|
|
|
// Throttle BEFORE touching the password so a locked-out client can't keep the guess loop spinning.
|
|
const wait = throttleRetryAfterMs(ip);
|
|
if (wait > 0) {
|
|
setResponseHeader(event, "Retry-After", Math.ceil(wait / 1000));
|
|
throw createError({
|
|
statusCode: 429,
|
|
statusMessage: "too many attempts — try again shortly",
|
|
});
|
|
}
|
|
|
|
const body = await readBody<{ password?: string }>(event);
|
|
const password = String(body?.password ?? "");
|
|
if (!timingSafeEqual(password, expected)) {
|
|
recordLoginFailure(ip);
|
|
throw createError({ statusCode: 401, statusMessage: "invalid password" });
|
|
}
|
|
recordLoginSuccess(ip);
|
|
const session = await useSession<SessionData>(event, sessionConfig());
|
|
await session.update({ authenticated: true });
|
|
return { ok: true };
|
|
});
|