Prune expired auth requests + add global max limit. Closes #2490

auth/indieauth/client.go

@@ -8,16 +8,48 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
+	"sync"
+	"time"
 
 	"github.com/owncast/owncast/core/data"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 )
 
-var pendingAuthRequests = make(map[string]*Request)
+var (
+	pendingAuthRequests = make(map[string]*Request)
+	lock                = sync.Mutex{}
+)
+
+const registrationTimeout = time.Minute * 10
+
+func init() {
+	go setupExpiredRequestPruner()
+}
+
+// Clear out any pending requests that have been pending for greater than
+// the specified timeout value.
+func setupExpiredRequestPruner() {
+	pruneExpiredRequestsTimer := time.NewTicker(registrationTimeout)
+
+	for range pruneExpiredRequestsTimer.C {
+		lock.Lock()
+		log.Debugln("Pruning expired IndieAuth requests.")
+		for k, v := range pendingAuthRequests {
+			if time.Since(v.Timestamp) > registrationTimeout {
+				delete(pendingAuthRequests, k)
+			}
+		}
+		lock.Unlock()
+	}
+}
 
 // StartAuthFlow will begin the IndieAuth flow by generating an auth request.
 func StartAuthFlow(authHost, userID, accessToken, displayName string) (*url.URL, error) {
+	if len(pendingAuthRequests) >= maxPendingRequests {
+		return nil, errors.New("Please try again later. Too many pending requests.")
+	}
+
 	serverURL := data.GetServerURL()
 	if serverURL == "" {
 		return nil, errors.New("Owncast server URL must be set when using auth")

auth/indieauth/helpers.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"time"
 
 	"github.com/andybalholm/cascadia"
 	"github.com/pkg/errors"
@@ -63,6 +64,7 @@ func createAuthRequest(authDestination, userID, displayName, accessToken, baseSe
 		State:              state,
 		Redirect:           &redirect,
 		Callback:           &callbackURL,
+		Timestamp:          time.Now(),
 	}, nil
 }
 

auth/indieauth/indieauth_test.go

@@ -0,0 +1,35 @@
+package indieauth
+
+import (
+	"testing"
+
+	"github.com/owncast/owncast/utils"
+)
+
+func TestLimitGlobalPendingRequests(t *testing.T) {
+	// Simulate 10 pending requests
+	for i := 0; i < maxPendingRequests-1; i++ {
+		cid, _ := utils.GenerateRandomString(10)
+		redirectURL, _ := utils.GenerateRandomString(10)
+		cc, _ := utils.GenerateRandomString(10)
+		state, _ := utils.GenerateRandomString(10)
+		me, _ := utils.GenerateRandomString(10)
+
+		_, err := StartServerAuth(cid, redirectURL, cc, state, me)
+		if err != nil {
+			t.Error("Registration should be permitted.", i, " of ", len(pendingAuthRequests), err)
+		}
+	}
+
+	// This should throw an error
+	cid, _ := utils.GenerateRandomString(10)
+	redirectURL, _ := utils.GenerateRandomString(10)
+	cc, _ := utils.GenerateRandomString(10)
+	state, _ := utils.GenerateRandomString(10)
+	me, _ := utils.GenerateRandomString(10)
+
+	_, err := StartServerAuth(cid, redirectURL, cc, state, me)
+	if err == nil {
+		t.Error("Registration should not be permitted.")
+	}
+}

auth/indieauth/request.go

@@ -1,6 +1,9 @@
 package indieauth
 
-import "net/url"
+import (
+	"net/url"
+	"time"
+)
 
 // Request represents a single in-flight IndieAuth request.
 type Request struct {
@@ -15,4 +18,5 @@ type Request struct {
 	CodeChallenge      string
 	State              string
 	Me                 *url.URL
+	Timestamp          time.Time
 }

auth/indieauth/server.go

@@ -2,6 +2,7 @@ package indieauth
 
 import (
 	"fmt"
+	"time"
 
 	"github.com/owncast/owncast/core/data"
 	"github.com/pkg/errors"
@@ -17,6 +18,7 @@ type ServerAuthRequest struct {
 	State         string
 	Me            string
 	Code          string
+	Timestamp     time.Time
 }
 
 // ServerProfile represents basic user-provided data about this Owncast instance.
@@ -38,10 +40,16 @@ type ServerProfileResponse struct {
 
 var pendingServerAuthRequests = map[string]ServerAuthRequest{}
 
+const maxPendingRequests = 1000
+
 // StartServerAuth will handle the authentication for the admin user of this
 // Owncast server. Initiated via a GET of the auth endpoint.
 // https://indieweb.org/authorization-endpoint
 func StartServerAuth(clientID, redirectURI, codeChallenge, state, me string) (*ServerAuthRequest, error) {
+	if len(pendingServerAuthRequests)+1 >= maxPendingRequests {
+		return nil, errors.New("Please try again later. Too many pending requests.")
+	}
+
 	code := shortid.MustGenerate()
 
 	r := ServerAuthRequest{
@@ -51,6 +59,7 @@ func StartServerAuth(clientID, redirectURI, codeChallenge, state, me string) (*S
 		State:         state,
 		Me:            me,
 		Code:          code,
+		Timestamp:     time.Now(),
 	}
 
 	pendingServerAuthRequests[code] = r