Jakach/jakach-login
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adding enhanced csrf protection
Deploy / deploy (push) Successful in 33s
Details

Browse Source
This commit is contained in:
janis steiner
2026-05-06 09:07:48 +02:00
parent 7ae7df0a11
commit d82a08f77b
25 changed files with 132 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app-code/api/account/update_2fa.php
+4
View File
@@ -2,7 +2,11 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
// Check if the user is logged in
require_logged_in();
app-code/api/account/update_message.php
+4
View File
@@ -2,7 +2,11 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
// Check if the user is logged in
require_logged_in();
app-code/api/account/update_passkey.php
+1
View File
@@ -6,6 +6,7 @@ header('Content-Type: application/json');
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
require_once 'WebAuthn.php';
app-code/api/account/update_pw.php
+4
View File
@@ -2,7 +2,11 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
// Check if the user is logged in
require_logged_in();
app-code/api/account/update_user_data.php
+1
View File
@@ -2,6 +2,7 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
// Check if the user is logged in
app-code/api/login/check_mfa.php
+4
View File
@@ -2,7 +2,11 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
$send_to=$_SESSION["end_url"];
include "../../config/config.php";
app-code/api/login/check_passkey.php
+1
View File
@@ -3,6 +3,7 @@ header('Content-Type: application/json');
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
require_once 'WebAuthn.php';
include "../../config/config.php";
$conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD,$DB_DATABASE);
app-code/api/login/check_pw.php
+4
View File
@@ -2,7 +2,11 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
$send_to=$_SESSION["end_url"];
include "../../config/config.php";
app-code/api/login/delete_keepmeloggedin.php
+5
View File
@@ -2,7 +2,12 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST' && $_SERVER['REQUEST_METHOD'] !== 'DELETE') {
echo json_encode(['success' => false, 'message' => 'Invalid request method.']);
exit;
}
$send_to=$_SESSION["end_url"];
require_logged_in();
app-code/api/login/keepmeloggedin.php
+4
View File
@@ -2,7 +2,11 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
$send_to=$_SESSION["end_url"];
include "../../config/config.php";
app-code/api/login/reset_pw.php
+4 -1
View File
@@ -1,4 +1,8 @@
<?php
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
// Check if the POST request contains 'token' and 'password'
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!isset($_POST['token']) || !isset($_POST['password']) || !isset($_POST['confirm_password'])) {
@@ -67,4 +71,3 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
echo json_encode(['status' => 'error', 'message' => 'Invalid request method.']);
}
?>
app-code/api/login/send_reset_link.php
+5
View File
@@ -2,7 +2,12 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
echo json_encode(['success' => false, 'message' => 'Invalid request method.']);
exit;
}
include "../../config/config.php";
include "../utils/get_location.php";
$username=$_SESSION["username"] ?? "";
app-code/api/login/set_username.php
+4
View File
@@ -2,6 +2,10 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
}
$_SESSION["needs_auth"]=true;
$_SESSION["logged_in"]=false;
$username = strtolower((string) ($_POST["username"] ?? ""));
app-code/api/manage/delete_user.php
+1
View File
@@ -3,6 +3,7 @@ header('Content-Type: application/json');
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
//check for permisisons
if (!isset($_SESSION["logged_in"]) || $_SESSION["logged_in"] !== true || !is_admin_session() ) {
echo(json_encode(['success' => false, 'message'=>'not authenticated']));
app-code/api/register/register_user.php
+1
View File
@@ -3,6 +3,7 @@
include "../utils/security.php";
secure_session_start();
require_same_origin_request();
require_csrf_token();
header('Content-Type: application/json');
include "../../config/config.php";
app-code/api/utils/security.php
+26
View File
@@ -53,6 +53,32 @@ function require_same_origin_request(): void
}
}
function csrf_token(): string
{
if (empty($_SESSION['csrf_token']) || !is_string($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
return $_SESSION['csrf_token'];
}
function print_csrf_script(): void
{
echo '<script>window.csrfToken = ' . json_encode(csrf_token()) . ';</script>';
}
function require_csrf_token(): void
{
if (!in_array($_SERVER['REQUEST_METHOD'] ?? 'GET', ['POST', 'PUT', 'PATCH', 'DELETE'], true)) {
return;
}
$token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? $_POST['csrf_token'] ?? '';
if (empty($_SESSION['csrf_token']) || !is_string($token) || !hash_equals($_SESSION['csrf_token'], $token)) {
json_response(['success' => false, 'message' => 'Invalid CSRF token.'], 403);
}
}
function require_logged_in(): void
{
if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true || empty($_SESSION['id'])) {