axum_session/sec/

signed.rs

use std::borrow::{Borrow, BorrowMut};

use hmac::{Hmac, Mac};
use sha2::Sha256;

use cookie::{Cookie, CookieJar, Key};

// Keep these in sync, and keep the key len synced with the `signed` docs as
// well as the `KEYS_INFO` const in secure::Key.
pub(crate) const BASE64_DIGEST_LEN: usize = 44;
pub(crate) const KEY_LEN: usize = 32;

use base64::{prelude::BASE64_STANDARD, DecodeError, Engine};

/// Encode `input` as the standard base64 with padding.
pub(crate) fn encode<T: AsRef<[u8]>>(input: T) -> String {
    BASE64_STANDARD.encode(input)
}

/// Decode `input` as the standard base64 with padding.
pub(crate) fn decode<T: AsRef<[u8]>>(input: T) -> Result<Vec<u8>, DecodeError> {
    BASE64_STANDARD.decode(input)
}

pub trait CookiesAdditionJar {
    fn message_signed<'a>(&'a self, key: &Key, message: String) -> AdditionalSignedJar<&'a Self>;
    fn message_signed_mut<'a>(
        &'a mut self,
        key: &Key,
        message: String,
    ) -> AdditionalSignedJar<&'a mut Self>;
}

impl CookiesAdditionJar for CookieJar {
    fn message_signed<'a>(&'a self, key: &Key, message: String) -> AdditionalSignedJar<&'a Self> {
        AdditionalSignedJar::new(self, key, message)
    }

    fn message_signed_mut<'a>(
        &'a mut self,
        key: &Key,
        message: String,
    ) -> AdditionalSignedJar<&'a mut Self> {
        AdditionalSignedJar::new(self, key, message)
    }
}

/// A child cookie jar that authenticates its cookies and Adds Additional measures to ensure integrity.
pub struct AdditionalSignedJar<J> {
    parent: J,
    key: [u8; KEY_LEN],
    message: String,
}

impl<J> AdditionalSignedJar<J> {
    /// Creates a new child `AdditionalSignedJar`
    pub(crate) fn new(parent: J, key: &Key, message: String) -> AdditionalSignedJar<J> {
        AdditionalSignedJar {
            parent,
            key: key.signing().try_into().expect("sign key len"),
            message,
        }
    }

    /// Signs the cookie's value and message providing integrity and authenticity.
    fn sign_cookie(&self, cookie: &mut Cookie) {
        // Compute HMAC-SHA256 of the cookie's value.
        let mut mac = match Hmac::<Sha256>::new_from_slice(&self.key) {
            Ok(v) => v,
            Err(err) => {
                tracing::error!(err = %err,  "key is invalid." );
                return;
            }
        };

        // Add the payload to the message first.
        let message = format!("{}{}", cookie.value(), &self.message);
        mac.update(message.as_bytes());

        // Cookie's new value is [MAC | original-value].
        let mut new_value = encode(mac.finalize().into_bytes());
        new_value.push_str(cookie.value());
        cookie.set_value(new_value);
    }

    /// Given a signed value `str` where the signature is prepended to `value`,
    /// verifies the signed value and returns it. If there's a problem, returns
    /// an `Err` with a string describing the issue.
    fn _verify(&self, cookie_value: &str) -> Result<String, &'static str> {
        if !cookie_value.is_char_boundary(BASE64_DIGEST_LEN) {
            return Err("missing or invalid digest");
        }

        // Split [MAC | original-value] into its two parts.
        let (digest_str, value) = cookie_value.split_at(BASE64_DIGEST_LEN);
        let digest = decode(digest_str).map_err(|_| "bad base64 digest")?;

        // Perform the verification.
        let mut mac = Hmac::<Sha256>::new_from_slice(&self.key).map_err(|_| "key is invalid.")?;
        // Add message here so we can check if it matches.
        let message = format!("{}{}", value, &self.message);
        mac.update(message.as_bytes());
        mac.verify_slice(&digest)
            .map(|_| value.to_string())
            .map_err(|_| "value did not verify")
    }

    /// Verifies the authenticity and integrity of `cookie`, returning the
    /// plaintext version if verification succeeds or `None` otherwise.
    /// Verification _always_ succeeds if `cookie` was generated by a
    /// `AdditionalSignedJar` with the same key and message as `self`.
    ///
    /// # Example
    ///
    /// ```rust ignore
    /// use cookie::{CookieJar, Cookie, Key};
    ///
    /// let key = Key::generate();
    /// let mut jar = CookieJar::new();
    /// assert!(jar.message_signed(&key, "".to_owned()).get("name").is_none());
    ///
    /// jar.message_signed_mut(&key, "".to_owned()).add(("name", "value"));
    /// assert_eq!(jar.message_signed(&key, "".to_owned()).get("name").unwrap().value(), "value");
    ///
    /// let plain = jar.get("name").cloned().unwrap();
    /// assert_ne!(plain.value(), "value");
    /// let verified = jar.message_signed(&key, "".to_owned()).verify(plain).unwrap();
    /// assert_eq!(verified.value(), "value");
    ///
    /// let plain = Cookie::new("plaintext", "hello");
    /// assert!(jar.message_signed(&key, "".to_owned()).verify(plain).is_none());
    /// ```
    pub fn verify(&self, mut cookie: Cookie<'static>) -> Option<Cookie<'static>> {
        match self._verify(cookie.value()) {
            Ok(value) => {
                cookie.set_value(value);
                Some(cookie)
            }
            Err(err) => {
                tracing::warn!(
                    err = %err,
                    "possibly suspicious activity: Verification failed for Cookie. cookie validation string was: {}",
                    self.message
                );
                None
            }
        }
    }
}

impl<J: Borrow<CookieJar>> AdditionalSignedJar<J> {
    /// Returns a reference to the `Cookie` inside this jar with the name `name`
    /// and verifies the authenticity and integrity of the cookie's value,
    /// returning a `Cookie` with the authenticated value. If the cookie cannot
    /// be found, or the cookie fails to verify, `None` is returned.
    ///
    /// # Example
    ///
    /// ```rust ignore
    /// use cookie::{CookieJar, Cookie, Key};
    ///
    /// let key = Key::generate();
    /// let jar = CookieJar::new();
    /// assert!(jar.message_signed(&key, "".to_owned()).get("name").is_none());
    ///
    /// let mut jar = jar;
    /// let mut signed_jar = jar.message_signed_mut(&key, "".to_owned());
    /// signed_jar.add(Cookie::new("name", "value"));
    /// assert_eq!(signed_jar.get("name").unwrap().value(), "value");
    /// ```
    pub fn get(&self, name: &str) -> Option<Cookie<'static>> {
        self.parent
            .borrow()
            .get(name)
            .and_then(|c| self.verify(c.clone()))
    }
}

impl<J: BorrowMut<CookieJar>> AdditionalSignedJar<J> {
    /// Adds `cookie` to the parent jar. The cookie's value is signed assuring
    /// integrity and authenticity.
    ///
    /// # Example
    ///
    /// ```rust ignore
    /// use cookie::{CookieJar, Cookie, Key};
    ///
    /// let key = Key::generate();
    /// let mut jar = CookieJar::new();
    /// jar.message_signed_mut(&key, "".to_owned()).add(("name", "value"));
    ///
    /// assert_ne!(jar.get("name").unwrap().value(), "value");
    /// assert!(jar.get("name").unwrap().value().contains("value"));
    /// assert_eq!(jar.message_signed(&key, "".to_owned()).get("name").unwrap().value(), "value");
    /// ```
    pub fn add<C: Into<Cookie<'static>>>(&mut self, cookie: C) {
        let mut cookie = cookie.into();
        self.sign_cookie(&mut cookie);
        self.parent.borrow_mut().add(cookie);
    }

    /// Adds an "original" `cookie` to this jar. The cookie's value is signed
    /// assuring integrity and authenticity. Adding an original cookie does not
    /// affect the [`CookieJar::delta()`] computation. This method is intended
    /// to be used to seed the cookie jar with cookies received from a client's
    /// HTTP message.
    ///
    /// For accurate `delta` computations, this method should not be called
    /// after calling `remove`.
    ///
    /// # Example
    ///
    /// ```rust ignore
    /// use cookie::{CookieJar, Cookie, Key};
    ///
    /// let key = Key::generate();
    /// let mut jar = CookieJar::new();
    /// jar.message_signed_mut(&key, "".to_owned()).add_original(("name", "value"));
    ///
    /// assert_eq!(jar.iter().count(), 1);
    /// assert_eq!(jar.delta().count(), 0);
    /// ```
    pub fn add_original<C: Into<Cookie<'static>>>(&mut self, cookie: C) {
        let mut cookie = cookie.into();
        self.sign_cookie(&mut cookie);
        self.parent.borrow_mut().add_original(cookie);
    }

    /// Removes `cookie` from the parent jar.
    ///
    /// For correct removal, the passed in `cookie` must contain the same `path`
    /// and `domain` as the cookie that was initially set.
    ///
    /// This is identical to [`CookieJar::remove()`]. See the method's
    /// documentation for more details.
    ///
    /// # Example
    ///
    /// ```rust ignore
    /// use cookie::{CookieJar, Cookie, Key};
    ///
    /// let key = Key::generate();
    /// let mut jar = CookieJar::new();
    /// let mut signed_jar = jar.message_signed_mut(&key, "".to_owned());
    ///
    /// signed_jar.add(("name", "value"));
    /// assert!(signed_jar.get("name").is_some());
    ///
    /// signed_jar.remove("name");
    /// assert!(signed_jar.get("name").is_none());
    /// ```
    pub fn remove<C: Into<Cookie<'static>>>(&mut self, cookie: C) {
        self.parent.borrow_mut().remove(cookie.into());
    }
}

pub(crate) fn sign_header(value: &str, key: &Key, message: &str) -> Result<String, &'static str> {
    // Compute HMAC-SHA256 of the cookie's value.
    let mut mac = Hmac::<Sha256>::new_from_slice(key.signing()).map_err(|_| "Key was invalid.")?;
    // Add the payload to the message first.
    let message = format!("{value}{message}");
    mac.update(message.as_bytes());

    // Cookie's new value is [MAC | original-value].
    let mut new_value = encode(mac.finalize().into_bytes());
    new_value.push_str(value);
    Ok(new_value)
}

/// Given a signed value `str` where the signature is prepended to `value`,
/// verifies the signed value and returns it. If there's a problem, returns
/// an `Err` with a string describing the issue.
pub(crate) fn verify_header(
    header_value: &str,
    key: &Key,
    message: &str,
) -> Result<String, &'static str> {
    if !header_value.is_char_boundary(BASE64_DIGEST_LEN) {
        return Err("missing or invalid digest");
    }

    // Split [MAC | original-value] into its two parts.
    let (digest_str, value) = header_value.split_at(BASE64_DIGEST_LEN);
    let digest = decode(digest_str).map_err(|_| "bad base64 digest")?;

    // Perform the verification.
    let mut mac = Hmac::<Sha256>::new_from_slice(key.signing()).map_err(|_| "Key was invalid.")?;
    // Add message here so we can check if it matches.
    let message = format!("{value}{message}");
    mac.update(message.as_bytes());
    mac.verify_slice(&digest)
        .map(|_| value.to_string())
        .map_err(|_| "value did not verify")
}

#[cfg(test)]
mod test {
    use crate::sec::signed::CookiesAdditionJar;
    use cookie::{Cookie, CookieJar, Key};

    #[test]
    fn roundtrip() {
        // Secret is SHA-256 hash of 'Super secret!' passed through HKDF-SHA256.
        let key = Key::from(&[
            89, 202, 200, 125, 230, 90, 197, 245, 166, 249, 34, 169, 135, 31, 20, 197, 94, 154,
            254, 79, 60, 26, 8, 143, 254, 24, 116, 138, 92, 225, 159, 60, 157, 41, 135, 129, 31,
            226, 196, 16, 198, 168, 134, 4, 42, 1, 196, 24, 57, 103, 241, 147, 201, 185, 233, 10,
            180, 170, 187, 89, 252, 137, 110, 107,
        ]);

        let mut jar = CookieJar::new();
        jar.add(Cookie::new(
            "signed_with_ring014",
            "3tdHXEQ2kf6fxC7dWzBGmpSLMtJenXLKrZ9cHkSsl1w=Tamper-proof",
        ));
        jar.add(Cookie::new(
            "signed_with_ring016",
            "3tdHXEQ2kf6fxC7dWzBGmpSLMtJenXLKrZ9cHkSsl1w=Tamper-proof",
        ));

        let signed = jar.message_signed(&key, "".to_owned());
        assert_eq!(
            signed.get("signed_with_ring014").unwrap().value(),
            "Tamper-proof"
        );
        assert_eq!(
            signed.get("signed_with_ring016").unwrap().value(),
            "Tamper-proof"
        );
    }
}