Add origin restriction to session token

api/README.md

@@ -35,6 +35,7 @@ Some environment variables are pre-configured for the development. You can copy
 - `AUTH_SIGNUP_ENABLED` (optional, default: `false`): if signing up mutation is allowed (i.e. user creation via endpoint is enabled)
 - `JWT_EXPIRATION_PERIOD` (optional, default: `'7d'`): how soon the signed jwt token will expire
 - `DEBUG` (optional): if set, enables the different more explicit logging mode where debug levels are set to `debug` for the app's logger and `query` for db logger
+- `OWN_ORIGIN` (optional, default: `'http://localhost:*'`): defines the origin where the api is located. The generated sign in and sign up tokens will be restricted to this value.
 
 ### Database
 

api/package.json

@@ -34,6 +34,7 @@
         "pino-pretty": "^10.0.0",
         "vite-node": "^0.29.2",
         "vitest": "^0.29.2",
+        "wildcard-match": "^5.1.2",
         "zod": "^3.21.4"
     },
     "devDependencies": {

api/prisma/schema.prisma

@@ -36,6 +36,7 @@ model Session {
   revokedAt           DateTime?
   referenceTokenId    String
   isUserCreated       Boolean   @default(false)
+  allowedOrigins      String // comma separated strings
 
   creator User @relation(fields: [createdBy], references: [id], onDelete: Cascade)
 

api/src/env/index.ts

@@ -8,3 +8,4 @@ export const PORT = Number(process.env.PORT ?? '3000');
 export const isDevelopment = process.env.NODE_ENV === 'development';
 export const AUTH_SIGNUP_ENABLED = Boolean(process.env.AUTH_SIGNUP_ENABLED);
 export const JWT_EXPIRATION_PERIOD: string = getJwtExpirationPeriod();
+export const OWN_ORIGIN = process.env.OWN_ORIGIN || 'http://localhost:*';

api/src/generated/nexus.ts

@@ -41,6 +41,7 @@ declare global {
 
 export interface NexusGenInputs {
   SessionCreate: { // input type
+    allowedOrigins: string; // String!
     expiryDurationSeconds?: number | null; // Int
     name: string; // String!
   }
@@ -80,6 +81,7 @@ export interface NexusGenObjects {
   Mutation: {};
   Query: {};
   Session: { // root type
+    allowedOrigins?: string | null; // String
     createdAt: NexusGenScalars['GQLDateBase']; // GQLDateBase!
     createdBy: string; // String!
     id: string; // String!
@@ -138,6 +140,7 @@ export interface NexusGenFieldTypes {
     sessions: Array<NexusGenRootTypes['Session'] | null> | null; // [Session]
   }
   Session: { // field return type
+    allowedOrigins: string | null; // String
     createdAt: NexusGenScalars['GQLDateBase']; // GQLDateBase!
     createdBy: string; // String!
     id: string; // String!
@@ -186,6 +189,7 @@ export interface NexusGenFieldTypeNames {
     sessions: 'Session'
   }
   Session: { // field return type name
+    allowedOrigins: 'String'
     createdAt: 'GQLDateBase'
     createdBy: 'String'
     id: 'String'

api/src/generated/schema.graphql

@@ -36,6 +36,7 @@ type Query {
 }
 
 type Session {
+  allowedOrigins: String
   createdAt: GQLDateBase!
   createdBy: String!
   id: String!
@@ -47,6 +48,7 @@ type Session {
 }
 
 input SessionCreate {
+  allowedOrigins: String!
   expiryDurationSeconds: Int
   name: String!
 }

api/src/graphql/context.ts

@@ -28,11 +28,12 @@ export function createContext(params: CreateContextParams): Context {
   const { req } = params;
   const authorizationHeader = req.get('Authorization');
   const token = authorizationHeader?.replace('Bearer ', '');
+  const origin = req.get('Origin');
 
   return {
     request: params,
     prisma,
     apolloLogger,
-    getSession: async () => prisma.session.getSessionByToken(token),
+    getSession: async () => prisma.session.getSessionByToken(origin, token),
   };
 }

api/src/modules/Session/helpers.ts

@@ -0,0 +1,81 @@
+import type { PrismaClient, Prisma } from '@prisma/client';
+import { randomUUID } from 'crypto';
+import { GraphQLError } from 'graphql';
+import wildcard from 'wildcard-match';
+import { token as tokenUtils } from '../../helpers';
+
+function parseOriginMarkup(originParam: string): string {
+  if (originParam === '*') {
+    return '*';
+  }
+  const trimmedOriginParam = originParam.trim();
+  const origins = trimmedOriginParam.split(',').map((origin) => origin.trim());
+  origins.forEach((origin) => {
+    if (!origin.startsWith('http://') && !origin.startsWith('https://')) {
+      throw new GraphQLError("Origin must start with 'http://' or 'https://'", {
+        extensions: { code: 'INVALID_ORIGIN_PROTOCOL' },
+      });
+    }
+  });
+  return origins.join(',');
+}
+
+export function validateOriginAgainstAllowed(
+  allowedOrigins: string,
+  originReceived?: string,
+) {
+  if (allowedOrigins === '*') {
+    return;
+  }
+  if (!originReceived) {
+    throw new GraphQLError('Origin not provided', {
+      extensions: { code: 'ORIGIN_HEADER_MISSING' },
+    });
+  }
+  const allowedOriginsSplit = allowedOrigins.split(',');
+  if (!wildcard(allowedOriginsSplit)(originReceived)) {
+    throw new GraphQLError('Access denied due to origin restriction', {
+      extensions: { code: 'ORIGIN_FORBIDDEN' },
+    });
+  }
+}
+
+async function newSession(
+  prisma: PrismaClient,
+  session: Prisma.SessionCreateInput,
+) {
+  return prisma.session.create({
+    data: session,
+  });
+}
+
+export const generateTokenAndSession = async (
+  prisma: PrismaClient,
+  userId: string,
+  session: { expiryDurationSeconds?: number | null; name: string; allowedOrigins: string },
+  isUserCreated: boolean = false,
+) => {
+  const createId = randomUUID();
+  const createdToken = tokenUtils.generate(createId, session.expiryDurationSeconds);
+  const expiryDate = tokenUtils.getExpiryDateFromToken(createdToken);
+  const formattedToken = tokenUtils.format(createdToken);
+  const parsedAllowedOrigins = parseOriginMarkup(session.allowedOrigins);
+  const createData = {
+    allowedOrigins: parsedAllowedOrigins,
+    name: session.name,
+    referenceExpiryDate: expiryDate,
+    id: createId,
+    referenceTokenId: formattedToken,
+    isUserCreated,
+    creator: {
+      connect: {
+        id: userId,
+      },
+    },
+  };
+  const createdSession = await newSession(prisma, createData);
+  return {
+    token: createdToken,
+    session: createdSession,
+  };
+};

api/src/modules/Session/model.ts

@@ -1,10 +1,10 @@
-import type { PrismaClient, Prisma } from '@prisma/client';
+import type { PrismaClient } from '@prisma/client';
 import { inputObjectType, objectType } from 'nexus/dist';
-import { randomUUID } from 'crypto';
 import { GraphQLError } from 'graphql';
 import ms from 'ms';
 import { token as tokenUtils } from '../../helpers';
-import { JWT_EXPIRATION_PERIOD } from '../../env';
+import { JWT_EXPIRATION_PERIOD, OWN_ORIGIN } from '../../env';
+import { validateOriginAgainstAllowed, generateTokenAndSession } from './helpers';
 
 export const Session = objectType({
   name: 'Session',
@@ -17,6 +17,7 @@ export const Session = objectType({
     t.nonNull.boolean('isUserCreated');
     t.string('name');
     t.date('revokedAt');
+    t.string('allowedOrigins');
   },
 });
 
@@ -25,6 +26,7 @@ export const SessionCreate = inputObjectType({
   definition(t) {
     t.int('expiryDurationSeconds');
     t.nonNull.string('name');
+    t.nonNull.string('allowedOrigins');
   },
 });
 
@@ -36,44 +38,6 @@ export const SessionCreateOutput = objectType({
   },
 });
 
-async function newSession(
-  prisma: PrismaClient,
-  session: Prisma.SessionCreateInput,
-) {
-  return prisma.session.create({
-    data: session,
-  });
-}
-
-const generateTokenAndSession = async (
-  prisma: PrismaClient,
-  userId: string,
-  session: { expiryDurationSeconds?: number | null; name: string },
-  isUserCreated: boolean = false,
-) => {
-  const createId = randomUUID();
-  const createdToken = tokenUtils.generate(createId, session.expiryDurationSeconds);
-  const expiryDate = tokenUtils.getExpiryDateFromToken(createdToken);
-  const formattedToken = tokenUtils.format(createdToken);
-  const createData = {
-    name: session.name,
-    referenceExpiryDate: expiryDate,
-    id: createId,
-    referenceTokenId: formattedToken,
-    isUserCreated,
-    creator: {
-      connect: {
-        id: userId,
-      },
-    },
-  };
-  const createdSession = await newSession(prisma, createData);
-  return {
-    token: createdToken,
-    session: createdSession,
-  };
-};
-
 export function getSessionCrud(prisma: PrismaClient) {
   return {
     listSessions: async (userId: string) => prisma.session.findMany({
@@ -115,19 +79,20 @@ export function getSessionCrud(prisma: PrismaClient) {
     createSignInSession: async (userId: string) => generateTokenAndSession(
       prisma,
       userId,
-      { expiryDurationSeconds: ms(JWT_EXPIRATION_PERIOD) / 1000, name: 'Sign in' },
+      { expiryDurationSeconds: ms(JWT_EXPIRATION_PERIOD) / 1000, name: 'Sign in', allowedOrigins: OWN_ORIGIN },
     ),
     createSignUpSession: async (userId: string) => generateTokenAndSession(
       prisma,
       userId,
-      { expiryDurationSeconds: ms(JWT_EXPIRATION_PERIOD) / 1000, name: 'Sign up' },
+      { expiryDurationSeconds: ms(JWT_EXPIRATION_PERIOD) / 1000, name: 'Sign up', allowedOrigins: OWN_ORIGIN },
     ),
     createCustomSession: async (
       userId: string,
-      session: { expiryDurationSeconds?: number | null; name: string },
+      session: { expiryDurationSeconds?: number | null; name: string, allowedOrigins: string },
       isUserCreated: boolean = false,
     ) => generateTokenAndSession(prisma, userId, session, isUserCreated),
     async getSessionByToken(
+      origin?: string,
       token?: string,
     ) {
       if (!token) {
@@ -150,6 +115,7 @@ export function getSessionCrud(prisma: PrismaClient) {
           extensions: { code: 'SESSION_EXPIRED' },
         });
       }
+      validateOriginAgainstAllowed(session.allowedOrigins, origin);
       return session;
     },
 

api/tests/auth.test.ts

@@ -38,6 +38,7 @@ test('Authentication: sign up, sign in, request protected enpoint', async () =>
 
   const token = signInResponse?.signIn?.token;
   ctx.client.setHeader('Authorization', `Bearer ${token}`);
+  ctx.client.setHeader('Origin', 'http://localhost:3000');
 
   const meResponse = (await executeGraphQlQuery(meQuery)) as Record<
   string,