LogalDeveloper/owncast
0
Fork 0
Code Activity

Limit OTP requests to one per expiry window. Closes #2000

Browse Source
This commit is contained in:
Gabe Kangas
2022-08-02 13:29:06 -07:00
parent c40eaa47e9
commit 0b5ddf433b
3 changed files with 37 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
auth/fediverse/fediverse.go
View File

@@ -19,9 +19,19 @@ type OTPRegistration struct {
// to be active at a time.
var pendingAuthRequests = make(map[string]OTPRegistration)
const registrationTimeout = time.Minute * 10
// RegisterFediverseOTP will start the OTP flow for a user, creating a new
// code and returning it to be sent to a destination.
func RegisterFediverseOTP(accessToken, userID, userDisplayName, account string) OTPRegistration {
func RegisterFediverseOTP(accessToken, userID, userDisplayName, account string) (OTPRegistration, bool) {
request, requestExists := pendingAuthRequests[accessToken]
// If a request is already registered and has not expired then return that
// existing request.
if requestExists && time.Since(request.Timestamp) < registrationTimeout {
return request, false
}
code, _ := createCode()
r := OTPRegistration{
Code: code,
@@ -32,14 +42,14 @@ func RegisterFediverseOTP(accessToken, userID, userDisplayName, account string)
}
pendingAuthRequests[accessToken] = r
return r
return r, true
}
// ValidateFediverseOTP will verify a OTP code for a auth request.
func ValidateFediverseOTP(accessToken, code string) (bool, *OTPRegistration) {
request, ok := pendingAuthRequests[accessToken]
if !ok || request.Code != code || time.Since(request.Timestamp) > time.Minute*10 {
if !ok || request.Code != code || time.Since(request.Timestamp) > registrationTimeout {
return false, nil
}