CODEWITHSUNDEEP
node.jsvue.jspassport.jsvuex
Geddy
Geddy

Reputation: 95

Preventing man-in-the-middle attacks with user authentication (Node/Vue/Passport)

I currently have a webapp I'm writing in Node/Vuejs with Passport handling authentication, and I've run into a problem. I was thinking about how I have authentication currently set up and I realized I had a glaring security hole.

In short, I have my Vuex store hitting a local API endpoint /api/me. That endpoint does a simple return of req.user. For the sake of brevity, a typical response looks like this:

{
  username: 'Bob',
  roles: []  // normal user has no roles,
  email: '[email protected]'
}

My admin route /admin has a beforeEnter check, as shown below, that incorporates this check using the Vuex store, so I can have a cached version of user data accessible on the frontend.

{
      path: '/admin',
      name: '/admin',
      component: Admin,
      beforeEnter: (to, from, next) => {
        store.dispatch('getMe').then(() => {
          if (store.getters.user.roles && store.getters.user.roles.includes('administrator')) {
            next();
            return;
          }
          next({ path: '/' });
        });
      }
    }

Here's the thing though - I realized that someone could easily game the system. In fact, I tried it myself with a test, non-Adminstrator account, and I was able to get in by returning the following from a local server set up for this purpose in Postman:

{
  username: 'Super Admin Joe',
  roles: ['administrator']  // normal user has no roles,
  email: '[email protected]'
}

And viola! The user now has full access to admin pages.

My question is, how could I prevent against this?

I need to check that the user is authenticated on every page, but a potential attacker could quite easily proxy any request (in this case it's /api/me) to make themselves any user they want. They can login normally with their own account, open the Network tab and copy the response payload, then change the user data as they wish. There needs to be some sort of encryption between the frontend and backend when checking a users' logged-in status, I believe.

I tried thinking about how I could prevent this from happening, but anything on my end (server-side, at least) seems useless as any request could easily be redirected to an attacker's local machine.

Any advice on how to "sign" my requests to make sure they aren't being proxied? Thanks in advance!

Upvotes: 2

Views: 1505

Answers (2)

Azami
Azami

Reputation: 2161

After reading your github files:

server.get("/admin", function(req, res){
    if(req.user && req.user.roles.includes("administrator")){
        //user is an administrator, render the admin panel view
    }else{
        //is not an admin, redirect or send error message
    }
});

In every Express route, after authentication with Passport, you have the req.user object.

It is established by checking the request cookie connect.sid, and checking which session this cookie belongs to on the server. As such, you can trust that in any Express route, the object req.user contains the information relevant to that cookie and you can act upon it.

A little note: doing server-side validation should become a reflex for you over time.

The client is meant to display information. If, at any point, you are making the client take any decision that could be a security liability, take a step back and think it again.

Upvotes: 1

Randy
Randy

Reputation: 1255

You shouldn’t have to be signing the response body of an api request. The typical way to do authentication is to establish a signed session cookie that acts either as an identifier to session information in an external database, or contains session information itself. This cookie should be in the header of your response and passport should give you a way to administer this cookie without you even realizing it.

This way the user can’t tamper with the information sent from the server in a way that’s easy to detect, and since it’s a cookie it will automatically be sent with each request by your browser (although if you’re using some AJAX library you may have to explicitly specify you’d like to send the cookie). What MadEard was referring to in the comment is where the cookie information is able to be accessed using passprt which is the ‘user’ property in the ‘req’ object.

Upvotes: 4

Related Questions