Parent5446 has uploaded a new change for review.
https://gerrit.wikimedia.org/r/132783
Change subject: Cache OATH tokens to avoid replay
......................................................................
Cache OATH tokens to avoid replay
Once a token is used, cache it in memcached
for a brief amount of time (specifically, until
the window in which it is valid ends). That way
once a token is used it cannot be re-used in
a replay attack.
Bug: 53196
Change-Id: I7b8e92875a573f3ac95e13c881ef85464bcecf85
---
M OATHUser.php
1 file changed, 30 insertions(+), 18 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/OATHAuth
refs/changes/83/132783/1
diff --git a/OATHUser.php b/OATHUser.php
index 355df2f..3606639 100644
--- a/OATHUser.php
+++ b/OATHUser.php
@@ -143,31 +143,43 @@
* @return Boolean
*/
public function verifyToken( $token, $reset = false ) {
- if ( $reset ) {
- $secret = $this->secretReset;
- } else {
- $secret = $this->secret;
+ global $wgMemc;
+
+ // Prevent replay attacks
+ $memcKey = wfMemcKey( 'oauthauth', 'usedtokens', $reset ?
'reset' : null, $token );
+ if ( $wgMemc->get( $memcKey ) ) {
+ return false;
}
+
+ $retval = false;
+ $secret = $reset ? $this->secretReset : $this->secret;
$results = HOTP::generateByTimeWindow( Base32::decode( $secret
), 30, -4, 4 );
- # Check to see if the user's given token is in the list of
tokens generated
- # for the time window.
+ // Check to see if the user's given token is in the list of
tokens generated
+ // for the time window.
foreach ( $results as $result ) {
if ( $result->toHOTP( 6 ) === $token ) {
- return true;
- }
- }
- # See if the user is using a scratch token
- $length = count( $this->scratchTokens );
- for ( $i = 0; $i < $length; $i++ ) {
- if ( $token === $this->scratchTokens[$i] ) {
- # If there is a scratch token, remove it from
the scratch token list
- unset( $this->scratchTokens[$i] );
- # Only return true if we removed it from the
database
- return $this->updateScratchTokens();
+ $retval = true;
+ break;
}
}
- return false;
+ // See if the user is using a scratch token
+ $length = count( $this->scratchTokens );
+ for ( $i = 0; $i < $length; $i++ ) {
+ if ( $token === $this->scratchTokens[$i] ) {
+ // If there is a scratch token, remove it from
the scratch token list
+ unset( $this->scratchTokens[$i] );
+ // Only return true if we removed it from the
database
+ $retval = $this->updateScratchTokens();
+ break;
+ }
+ }
+
+ if ( $retval ) {
+ $wgMemc->set( $memcKey, true, 30 * 8 );
+ }
+
+ return $retval;
}
/**
--
To view, visit https://gerrit.wikimedia.org/r/132783
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I7b8e92875a573f3ac95e13c881ef85464bcecf85
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/OATHAuth
Gerrit-Branch: master
Gerrit-Owner: Parent5446 <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
