auth token secret

application/Espo/Core/Utils/Auth.php

@@ -142,6 +142,8 @@ class Auth
             }
         }
 
+        $createTokenSecret = $this->request->headers->get('Espo-Authorization-Create-Token-Secret') === 'true';
+
         if (!$isByTokenOnly) {
             $this->checkFailedAttemptsLimit($username);
         }
@@ -153,6 +155,15 @@ class Auth
             $authToken = $this->getEntityManager()->getRepository('AuthToken')->where([
                 'token' => $password
             ])->findOne();
+
+            if ($authToken) {
+                if ($authToken->get('secret')) {
+                    $sentSecret = $_COOKIE['auth-token-secret'] ?? null;
+                    if ($sentSecret !== $authToken->get('secret')) {
+                        $authToken = null;
+                    }
+                }
+            }
         }
 
         if ($authToken) {
@@ -255,6 +266,14 @@ class Auth
                 $authToken->set('hash', $user->get('password'));
                 $authToken->set('ipAddress', $_SERVER['REMOTE_ADDR']);
                 $authToken->set('userId', $user->id);
+
+                if ($createTokenSecret) {
+                    $secret = $this->generateToken();
+                    $authToken->set('secret', $secret);
+
+                    setcookie('auth-token-secret', $secret, strtotime('+1000 days'), '/; samesite=lax', '', false, true);
+                }
+
                 if ($this->isPortal()) {
                     $authToken->set('portalId', $this->getPortal()->id);
                 }

application/Espo/Resources/metadata/entityAcl/AuthToken.json

@@ -8,6 +8,10 @@
             "internal": true,
             "readOnly": true
         },
+        "secret": {
+            "internal": true,
+            "readOnly": true
+        },
         "portal": {
             "readOnly": true
         },

application/Espo/Resources/metadata/entityDefs/AuthToken.json

@@ -12,6 +12,11 @@
             "index": true,
             "readOnly": true
         },
+        "secret": {
+            "type": "varchar",
+            "maxLength": "36",
+            "readOnly": true
+        },
         "userId": {
             "type": "varchar",
             "maxLength": "36",

client/src/views/login.js

@@ -110,6 +110,7 @@ define('views/login', 'view', function (Dep) {
                         'Authorization': 'Basic ' + Base64.encode(userName  + ':' + password),
                         'Espo-Authorization': Base64.encode(userName + ':' + password),
                         'Espo-Authorization-By-Token': false,
+                        'Espo-Authorization-Create-Token-Secret': true,
                     },
                 }).then(
                     function (data) {