path: root/echo/middleware/csrf.go

package middleware

import (
	"crypto/rand"
	"crypto/subtle"
	"encoding/base64"
	"fmt"
	"net/http"
	"net/url"
	"strings"

	"code.crute.us/mcrute/golib/echo/session"
	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

const (
	csrfTokenContextKey = "__golib_echo_csrfToken"
	csrfSkipContextKey  = "__golib_echo_skipCsrf"
)

var (
	ErrInvalidOrigin    = echo.NewHTTPError(http.StatusBadRequest, "invalid origin")
	ErrInvalidReferer   = echo.NewHTTPError(http.StatusBadRequest, "invalid referer")
	ErrMissingReferer   = echo.NewHTTPError(http.StatusBadRequest, "referer header is missing")
	ErrCSRFTokenMissing = echo.NewHTTPError(http.StatusBadRequest, "CSRF token is missing")
	ErrCSRFTokenInvalid = echo.NewHTTPError(http.StatusBadRequest, "CSRF token is invalid")
)

type CSRFAwareSession interface {
	session.Session
	GetCSRFSecret() string
	SetCSRFSecret(string)
}

func generateRandomBytes(l int) ([]byte, error) {
	o := make([]byte, l)
	if _, err := rand.Read(o); err != nil {
		return nil, err
	}
	return o, nil
}

func xorBytes(a, b []byte) []byte {
	n := len(a)
	if len(b) < n {
		n = len(b)
	}

	res := make([]byte, n)
	for i := 0; i < n; i++ {
		res[i] = a[i] ^ b[i]
	}

	return res
}

func mask(token []byte, size int) string {
	sec, err := generateRandomBytes(size)
	if err != nil {
		return ""
	}
	val := append(sec, xorBytes(sec, token)...)
	return base64.StdEncoding.EncodeToString(val)
}

func decodeAndMask(token string, size int) string {
	t, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return ""
	}
	return mask(t, size)
}

func unmask(token string, size int) ([]byte, error) {
	t, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, err
	}

	if len(t) != size*2 {
		return nil, fmt.Errorf("unmask: token length incorrect")
	}

	return xorBytes(t[size:], t[:size]), nil
}

func GetCSRFToken(c echo.Context) string {
	return c.Get(csrfTokenContextKey).(string)
}

func DisableCSRFProtection() echo.MiddlewareFunc {
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			c.Set(csrfSkipContextKey, true)
			return next(c)
		}
	}
}

type CSRFConfig[T CSRFAwareSession] struct {
	Skipper        middleware.Skipper
	HeaderName     string
	FieldName      string
	TokenSize      int
	SessionStore   session.Store[T]
	TrustedOrigins []string
}

func CSRFProtect[T CSRFAwareSession](store session.Store[T]) echo.MiddlewareFunc {
	return CSRFProtectWithConfig(CSRFConfig[T]{
		Skipper:        middleware.DefaultSkipper,
		HeaderName:     "X-CSRF-Token",
		FieldName:      "csrf-token",
		TokenSize:      32,
		SessionStore:   store,
		TrustedOrigins: []string{},
	})
}

func CSRFProtectWithConfig[T CSRFAwareSession](cfg CSRFConfig[T]) echo.MiddlewareFunc {
	if cfg.Skipper == nil {
		cfg.Skipper = DefaultContentSecurityPolicyConfig.Skipper
	}
	if cfg.SessionStore == nil {
		panic("CSRFProtectWithConfig: SessionStore must not be nil")
	}

	trustedOrigins := make([]*url.URL, len(cfg.TrustedOrigins))
	for i, u := range cfg.TrustedOrigins {
		pu, err := url.Parse(u)
		if err != nil {
			// These are critical errors that should fail at server boot
			panic(fmt.Errorf("Error parsing TrustedOrigins URL: %w", err))
		}
		trustedOrigins[i] = pu
	}

	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			if cfg.Skipper(c) {
				return next(c)
			}

			if skip, ok := c.Get(csrfSkipContextKey).(bool); ok && skip {
				return next(c)
			}

			// If there's no CSRF token in the session then set one for future
			// requests, even if this request is safe.
			session := cfg.SessionStore.Get(c)
			if session.GetCSRFSecret() == "" {
				tok, err := generateRandomBytes(cfg.TokenSize)
				if err != nil {
					c.Logger().Errorf("CSRF: error generating token: %w", err)
					return echo.ErrInternalServerError
				}
				session.SetCSRFSecret(base64.StdEncoding.EncodeToString(tok))
			}

			// Stash this in the request context so that other things can get to
			// it without needing a direct session dependency.
			c.Set(csrfTokenContextKey, decodeAndMask(session.GetCSRFSecret(), cfg.TokenSize))

			// These methods are considered safe and do not require CRSF
			// protection.
			switch c.Request().Method {
			case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace:
				return next(c)
			}

			if origin := c.Request().Header.Get("Origin"); origin != "" {
				if err := validateOrigin(c, origin, trustedOrigins); err != nil {
					return err
				}
			} else if c.Request().URL.Scheme == "https" {
				// If the Origin header wasn't provided, reject HTTPS requests if
				// the Referer header doesn't match an allowed value.
				//
				// Suppose user visits http://example.com/
				// An active network attacker (man-in-the-middle, MITM) sends a
				// POST form that targets https://example.com/detonate-bomb/ and
				// submits it via JavaScript.
				//
				// The attacker will need to provide a CSRF cookie and token, but
				// that's no problem for a MITM and the session-independent secret
				// we're using. So the MITM can circumvent the CSRF protection. This
				// is true for any HTTP connection, but anyone using HTTPS expects
				// better! For this reason, for https://example.com/ we need
				// additional protection that treats http://example.com/ as
				// completely untrusted. Under HTTPS, Barth et al. found that the
				// Referer header is missing for same-domain requests in only about
				// 0.2% of cases or less, so we can use strict Referer checking.
				if err := validateReferer(c, trustedOrigins); err != nil {
					return err
				}
			}

			requestToken := getRequestToken(c.Request(), cfg.FieldName, cfg.HeaderName)
			if requestToken == "" {
				return ErrCSRFTokenMissing
			}

			unmasked, err := unmask(requestToken, cfg.TokenSize)
			if err != nil {
				c.Logger().Debugf("CSRF: error unmasking request token: %w", err)
				return ErrCSRFTokenInvalid
			}

			sessionToken, err := base64.StdEncoding.DecodeString(session.GetCSRFSecret())
			if err != nil {
				c.Logger().Debugf("CSRF: error decoding session token: %w", err)
				return ErrCSRFTokenInvalid
			}

			if subtle.ConstantTimeCompare(unmasked, sessionToken) != 1 {
				c.Logger().Debug("CSRF: session token and request token are not equal")
				return ErrCSRFTokenInvalid
			}

			c.Response().Header().Add("Vary", "Cookie")

			return next(c)
		}
	}
}

func getRequestToken(r *http.Request, fieldName, headerName string) string {
	token := r.Header.Get(headerName)
	if token == "" {
		token = r.PostFormValue(fieldName)
	}
	if token == "" && r.MultipartForm != nil {
		vals := r.MultipartForm.Value[fieldName]
		if len(vals) > 0 {
			token = vals[0]
		}
	}
	return token
}

func validateReferer(c echo.Context, trusted []*url.URL) error {
	referer := c.Request().Referer()
	if referer == "" {
		c.Logger().Debugf("CSRF: no referer in request")
		return ErrMissingReferer
	}

	u, err := url.Parse(referer)
	if err != nil {
		c.Logger().Debugf("CSRF: error parsing referer: %w", err)
		return ErrInvalidReferer
	}

	if u.Host == "" {
		c.Logger().Debugf("CSRF: no host in referer")
		return ErrInvalidReferer
	}

	if u.Scheme != "https" {
		c.Logger().Debugf("CSRF: referer is not https")
		return ErrInvalidReferer
	}

	for _, o := range trusted {
		if isSameDomain(u, o) {
			return nil
		}
	}

	return ErrInvalidReferer
}

func validateOrigin(c echo.Context, origin string, trusted []*url.URL) error {
	parsedOrigin, err := url.Parse(origin)
	if err != nil {
		c.Logger().Debugf("CSRF: Error parsing origin: %w", err)
		return ErrInvalidOrigin
	}

	thisHost := &url.URL{
		Scheme: c.Request().URL.Scheme,
		Host:   c.Request().Host,
	}

	if thisHost.Scheme == "" {
		if c.Request().TLS != nil {
			thisHost.Scheme = "https"
		} else {
			thisHost.Scheme = "http"
		}
	}

	if isSameDomain(parsedOrigin, thisHost) {
		return nil
	}

	for _, to := range trusted {
		if isSameDomain(parsedOrigin, to) {
			return nil
		}
	}

	return ErrInvalidOrigin
}

// isSameDomain checks that the host is either an exact match for the
// pattern, or in the case that a pattern starts with a dot, that the
// host has a suffix of that pattern to allow for subdomain matches
// (e.g. .example.com matches example.com and foo.example.com)
func isSameDomain(host, pattern *url.URL) bool {
	if host == nil || pattern == nil {
		return false
	}

	if host.Scheme != pattern.Scheme {
		return false
	}

	host.Host = strings.ToLower(host.Host)
	pattern.Host = strings.ToLower(pattern.Host)

	if pattern.Host == host.Host {
		return true
	}

	if strings.HasPrefix(pattern.Host, "*") {
		if strings.HasSuffix(host.Host, pattern.Host[1:]) {
			return true
		}
		if host.Host == pattern.Host[2:] {
			return true
		}
	}

	return false
}