From c0800a4d161f66c12a11f5d75a57f2821e66a2f1 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 6 Aug 2019 13:37:34 +0300
Subject: [PATCH] auth token secret

---
 application/Espo/Core/Utils/Auth.php          | 19 +++++++++++++++++++
 .../metadata/entityAcl/AuthToken.json         |  4 ++++
 .../metadata/entityDefs/AuthToken.json        |  5 +++++
 client/src/views/login.js                     |  1 +
 4 files changed, 29 insertions(+)

diff --git a/application/Espo/Core/Utils/Auth.php b/application/Espo/Core/Utils/Auth.php
index 5997e6ed8a..834f77afbf 100644
--- a/application/Espo/Core/Utils/Auth.php
+++ b/application/Espo/Core/Utils/Auth.php
@@ -142,6 +142,8 @@ class Auth
             }
         }
 
+        $createTokenSecret = $this->request->headers->get('Espo-Authorization-Create-Token-Secret') === 'true';
+
         if (!$isByTokenOnly) {
             $this->checkFailedAttemptsLimit($username);
         }
@@ -153,6 +155,15 @@ class Auth
             $authToken = $this->getEntityManager()->getRepository('AuthToken')->where([
                 'token' => $password
             ])->findOne();
+
+            if ($authToken) {
+                if ($authToken->get('secret')) {
+                    $sentSecret = $_COOKIE['auth-token-secret'] ?? null;
+                    if ($sentSecret !== $authToken->get('secret')) {
+                        $authToken = null;
+                    }
+                }
+            }
         }
 
         if ($authToken) {
@@ -255,6 +266,14 @@ class Auth
                 $authToken->set('hash', $user->get('password'));
                 $authToken->set('ipAddress', $_SERVER['REMOTE_ADDR']);
                 $authToken->set('userId', $user->id);
+
+                if ($createTokenSecret) {
+                    $secret = $this->generateToken();
+                    $authToken->set('secret', $secret);
+
+                    setcookie('auth-token-secret', $secret, strtotime('+1000 days'), '/; samesite=lax', '', false, true);
+                }
+
                 if ($this->isPortal()) {
                     $authToken->set('portalId', $this->getPortal()->id);
                 }
diff --git a/application/Espo/Resources/metadata/entityAcl/AuthToken.json b/application/Espo/Resources/metadata/entityAcl/AuthToken.json
index cf74d1ba98..b5a765e17e 100644
--- a/application/Espo/Resources/metadata/entityAcl/AuthToken.json
+++ b/application/Espo/Resources/metadata/entityAcl/AuthToken.json
@@ -8,6 +8,10 @@
             "internal": true,
             "readOnly": true
         },
+        "secret": {
+            "internal": true,
+            "readOnly": true
+        },
         "portal": {
             "readOnly": true
         },
diff --git a/application/Espo/Resources/metadata/entityDefs/AuthToken.json b/application/Espo/Resources/metadata/entityDefs/AuthToken.json
index c0c23c4e62..3e667dae42 100644
--- a/application/Espo/Resources/metadata/entityDefs/AuthToken.json
+++ b/application/Espo/Resources/metadata/entityDefs/AuthToken.json
@@ -12,6 +12,11 @@
             "index": true,
             "readOnly": true
         },
+        "secret": {
+            "type": "varchar",
+            "maxLength": "36",
+            "readOnly": true
+        },
         "userId": {
             "type": "varchar",
             "maxLength": "36",
diff --git a/client/src/views/login.js b/client/src/views/login.js
index 513f13d3e8..a4f159f665 100644
--- a/client/src/views/login.js
+++ b/client/src/views/login.js
@@ -110,6 +110,7 @@ define('views/login', 'view', function (Dep) {
                         'Authorization': 'Basic ' + Base64.encode(userName  + ':' + password),
                         'Espo-Authorization': Base64.encode(userName + ':' + password),
                         'Espo-Authorization-By-Token': false,
+                        'Espo-Authorization-Create-Token-Secret': true,
                     },
                 }).then(
                     function (data) {