Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhanced auth token / remember me #27606

Merged
merged 12 commits into from
Oct 14, 2023
Merged

Conversation

KN4CK3R
Copy link
Member

@KN4CK3R KN4CK3R commented Oct 13, 2023

Closes #27455

The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password.

To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.

⚠️ Breaking

The now obsolete setting [security].COOKIE_USERNAME has been removed.
If you previously set it, you can now remove it from your config.

@KN4CK3R KN4CK3R added type/feature Completely new functionality. Can only be merged if feature freeze is not active. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! labels Oct 13, 2023
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Oct 13, 2023
@pull-request-size pull-request-size bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Oct 13, 2023
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Oct 13, 2023
@delvh delvh added the pr/breaking Merging this PR means builds will break. Needs a description what exactly breaks, and how to fix it! label Oct 13, 2023
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Oct 13, 2023
@lunny lunny added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Oct 14, 2023
@lunny lunny enabled auto-merge (squash) October 14, 2023 00:21
@lunny lunny merged commit c6c829f into go-gitea:main Oct 14, 2023
25 checks passed
@GiteaBot GiteaBot added this to the 1.22.0 milestone Oct 14, 2023
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Oct 14, 2023
@KN4CK3R KN4CK3R deleted the feature-auth-token branch October 14, 2023 14:18
zjjhot added a commit to zjjhot/gitea that referenced this pull request Oct 16, 2023
* giteaofficial/main:
  [skip ci] Updated licenses and gitignores
  Improve retrying index issues (go-gitea#27554)
  Replace more db.DefaultContext (go-gitea#27628)
  Fix 404 when there is an internal version of package (go-gitea#27615)
  [skip ci] Updated translations via Crowdin
  Add anchor to review types (go-gitea#26894)
  Update readme to remove drone svg (go-gitea#27624)
  Change the default branch in the agit docs (go-gitea#27621)
  Final round of `db.DefaultContext` refactor (go-gitea#27587)
  Fix permissions for Token DELETE endpoint to match GET and POST (go-gitea#27610)
  Enhanced auth token / remember me (go-gitea#27606)
  [skip ci] Updated translations via Crowdin
  rm outdated docs from some languages (go-gitea#27530)
  Upgrade go dependencies (go-gitea#27599)
  Fix build errors on BSD (in BSDMakefile) (go-gitea#27594)
  Enable shorthands in `declaration-strict-value` linter (go-gitea#27597)
  [skip ci] Updated translations via Crowdin
  Make disk clean action a bit more robust (go-gitea#27590)
brechtvl added a commit to blender/gitea that referenced this pull request Nov 13, 2023
Without increasing database version.

From upstream go-gitea#27606

The mechanism responsible for long-term authentication (the 'remember
me' cookie) uses a weak construction technique. It will hash the user's
hashed password and the rands value; it will then call the secure cookie
code, which will encrypt the user's name with the computed hash. If one
were able to dump the database, they could extract those two values to
rebuild that cookie and impersonate a user. That vulnerability exists
from the date the dump was obtained until a user changed their password.

To fix this security issue, the cookie could be created and verified
using a different technique such as the one explained at
https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.

The PR removes the now obsolete setting `COOKIE_USERNAME`.
@go-gitea go-gitea locked as resolved and limited conversation to collaborators Jan 12, 2024
@delvh
Copy link
Member

delvh commented Feb 17, 2024

@KN4CK3R why is this PR a feature?
What does it change for users?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. modifies/docs modifies/migrations modifies/translation pr/breaking Merging this PR means builds will break. Needs a description what exactly breaks, and how to fix it! size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! type/feature Completely new functionality. Can only be merged if feature freeze is not active.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants