diff --git a/src/api/middlewares/Authentication.ts b/src/api/middlewares/Authentication.ts
index 4bb809a67..5d239a17e 100644
--- a/src/api/middlewares/Authentication.ts
+++ b/src/api/middlewares/Authentication.ts
@@ -70,6 +70,7 @@ declare global {
user_bot: boolean;
token: { id: string; iat: number };
rights: Rights;
+ fingerprint?: string;
}
}
}
@@ -77,6 +78,15 @@ declare global {
export async function Authentication(req: Request, res: Response, next: NextFunction) {
if (req.method === "OPTIONS") return res.sendStatus(204);
const url = req.url.replace(API_PREFIX, "");
+
+ if (req.headers.cookie?.split("; ").find((x) => x.startsWith("__sb_sessid=")))
+ req.fingerprint = req.headers.cookie
+ .split("; ")
+ .find((x) => x.startsWith("__sb_sessid="))!
+ .split("=")[1];
+ // for some reason we need to require here, else the openapi generator fails with "route is not a function"
+ else res.setHeader("Set-Cookie", `__sb_sessid=${req.fingerprint = (await require("../util")).randomString(32)}; Secure; HttpOnly; SameSite=None`);
+
if (
NO_AUTHORIZATION_ROUTES.some((x) => {
if (typeof x !== "string") {
@@ -102,10 +112,14 @@ export async function Authentication(req: Request, res: Response, next: NextFunc
})
)
return next();
+
if (!req.headers.authorization) return next(new HTTPError("Missing Authorization Header", 401));
try {
- const { decoded, user } = await checkToken(req.headers.authorization);
+ const { decoded, user } = await checkToken(req.headers.authorization, {
+ ipAddress: req.ip,
+ fingerprint: req.fingerprint,
+ });
req.token = decoded;
req.user_id = decoded.id;
diff --git a/src/api/routes/auth/reset.ts b/src/api/routes/auth/reset.ts
index b14eb3791..5cb5690d3 100644
--- a/src/api/routes/auth/reset.ts
+++ b/src/api/routes/auth/reset.ts
@@ -51,6 +51,8 @@ router.post(
try {
const userTokenData = await checkToken(token, {
select: ["email"],
+ fingerprint: req.fingerprint,
+ ipAddress: req.ip
});
user = userTokenData.user;
} catch {
diff --git a/src/api/routes/auth/verify/index.ts b/src/api/routes/auth/verify/index.ts
index d8e343cd2..8c636196e 100644
--- a/src/api/routes/auth/verify/index.ts
+++ b/src/api/routes/auth/verify/index.ts
@@ -75,7 +75,10 @@ router.post(
let user;
try {
- const userTokenData = await checkToken(token);
+ const userTokenData = await checkToken(token, {
+ fingerprint: req.fingerprint,
+ ipAddress: req.ip
+ });
user = userTokenData.user;
} catch {
throw FieldErrors({
|
