kawaandClaude Haiku 4.5
ed41f7f520
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
85 lines
2.9 KiB
Python
85 lines
2.9 KiB
Python
"""Cookie-scoped Owner session — opaque bearer key, no accounts."""
|
|
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
|
|
import imptune.config as cfg
|
|
from imptune.db.models import Owner
|
|
|
|
COOKIE_NAME = "imptune_owner_key"
|
|
COOKIE_MAX_AGE = 10 * 365 * 24 * 60 * 60 # 10 years
|
|
|
|
|
|
def generate_key() -> str:
|
|
return secrets.token_urlsafe(32)
|
|
|
|
|
|
def is_same_origin(request: Request) -> bool:
|
|
"""Origin/Referer check — the CSRF guard for /session/restore.
|
|
|
|
Restoring a key re-points the cookie at a *different* Owner, so unlike
|
|
the rest of the app's unprotected POSTs (which only ever mutate the
|
|
caller's own data), a forged cross-site POST here is a login-CSRF /
|
|
session-fixation vector: an attacker who knows their own key can force
|
|
a victim's browser onto the attacker's Owner. Browsers always send
|
|
Origin (and usually Referer) on form POSTs, same-site or not, so
|
|
requiring a match — and rejecting when both are absent — blocks a plain
|
|
auto-submitting HTML form without needing a token.
|
|
"""
|
|
expected = f"{request.url.scheme}://{request.url.netloc}"
|
|
|
|
origin = request.headers.get("origin")
|
|
if origin is not None:
|
|
return origin == expected
|
|
|
|
referer = request.headers.get("referer")
|
|
if referer:
|
|
from urllib.parse import urlparse
|
|
|
|
parsed = urlparse(referer)
|
|
return f"{parsed.scheme}://{parsed.netloc}" == expected
|
|
|
|
return False
|
|
|
|
|
|
class OwnerSessionMiddleware(BaseHTTPMiddleware):
|
|
"""Resolves request.state.owner from a cookie, creating one on first visit."""
|
|
|
|
async def dispatch(self, request: Request, call_next):
|
|
if request.url.path == "/health":
|
|
return await call_next(request)
|
|
|
|
key = request.cookies.get(COOKIE_NAME)
|
|
owner = Owner.get_or_none(Owner.key == key) if key else None
|
|
is_new = owner is None
|
|
if owner is None:
|
|
owner = Owner.create(key=generate_key(), is_permanent=False)
|
|
|
|
request.state.owner = owner
|
|
request.state.is_new_owner = is_new
|
|
|
|
response = await call_next(request)
|
|
|
|
# Routes like /session/restore intentionally set this cookie themselves
|
|
# (to a *different* owner than the one this middleware just minted) —
|
|
# don't clobber that with the auto-provisioned one.
|
|
route_already_set_cookie = any(
|
|
header.lower() == b"set-cookie" and value.startswith(f"{COOKIE_NAME}=".encode())
|
|
for header, value in response.raw_headers
|
|
)
|
|
|
|
if is_new and not route_already_set_cookie:
|
|
response.set_cookie(
|
|
COOKIE_NAME,
|
|
owner.key,
|
|
max_age=COOKIE_MAX_AGE,
|
|
httponly=True,
|
|
samesite="lax",
|
|
secure=cfg.COOKIE_SECURE,
|
|
)
|
|
|
|
return response
|