Authentication

import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
import { promisify } from 'node:util';

const scryptAsync = promisify(scrypt);

async function hashPassword(password) {
  const salt = randomBytes(16).toString('hex');
  const derived = await scryptAsync(password, salt, 64);
  return `${salt}:${derived.toString('hex')}`;
}

async function verifyPassword(password, stored) {
  const [salt, hashHex] = stored.split(':');
  const derived = await scryptAsync(password, salt, 64);
  return timingSafeEqual(derived, Buffer.from(hashHex, 'hex'));
}

const stored1 = await hashPassword('correct horse battery staple');
const stored2 = await hashPassword('correct horse battery staple');

console.log(`Stored value length: ${stored1.length}`);
console.log(`Same password, same hash? ${stored1 === stored2}`);
console.log(`Right password: ${await verifyPassword('correct horse battery staple', stored1)}`);
console.log(`Wrong password: ${await verifyPassword('Correct horse battery staple', stored1)}`);

import { createHmac, timingSafeEqual } from 'node:crypto';

const SECRET = 'demo-secret-from-env';
const b64 = (obj) => Buffer.from(JSON.stringify(obj)).toString('base64url');

function sign(payload) {
  const body = `${b64({ alg: 'HS256', typ: 'JWT' })}.${b64(payload)}`;
  const sig = createHmac('sha256', SECRET).update(body).digest('base64url');
  return `${body}.${sig}`;
}

function verify(token, now) {
  const [header, payload, sig] = token.split('.');
  const expected = createHmac('sha256', SECRET).update(`${header}.${payload}`).digest('base64url');
  if (sig.length !== expected.length || !timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    throw new Error('Bad signature');
  }
  const claims = JSON.parse(Buffer.from(payload, 'base64url').toString());
  if (claims.exp < now) throw new Error('Token expired');
  return claims;
}

const token = sign({ sub: '42', role: 'customer', exp: 1_800_000_000 });
console.log(token.split('.').length);
console.log(verify(token, 1_700_000_000));

const [h, p, s] = token.split('.');
const forged = `${h}.${b64({ sub: '42', role: 'admin', exp: 1_800_000_000 })}.${s}`;
for (const [label, t, now] of [['forged', forged, 1_700_000_000], ['expired', token, 1_900_000_000]]) {
  try {
    verify(t, now);
  } catch (err) {
    console.log(`${label}: ${err.message}`);
  }
}

import express from 'express';
import { randomBytes } from 'node:crypto';

const users = { ada: { password: 'pw-ada', role: 'admin' }, ben: { password: 'pw-ben', role: 'customer' } };
const sessions = new Map();

const app = express();
app.use(express.json());

app.post('/login', (req, res) => {
  const user = users[req.body.username];
  if (!user || user.password !== req.body.password) {
    return res.status(401).json({ error: 'Wrong username or password' });
  }
  const sid = randomBytes(24).toString('base64url');
  sessions.set(sid, { username: req.body.username, role: user.role });
  res.cookie('sid', sid, { httpOnly: true, secure: true, sameSite: 'lax', maxAge: 3600_000 });
  res.json({ ok: true });
});

function requireUser(req, res, next) {
  const sid = req.get('Cookie')?.match(/sid=([\w-]+)/)?.[1];
  req.user = sessions.get(sid);
  if (!req.user) return res.status(401).json({ error: 'Please sign in' });
  next();
}

app.get('/account', requireUser, (req, res) => res.json({ hello: req.user.username }));
app.get('/admin', requireUser, (req, res) =>
  req.user.role === 'admin' ? res.json({ secret: 'sales report' }) : res.status(403).json({ error: 'Forbidden' }));

const server = app.listen(0, async () => {
  const base = `http://localhost:${server.address().port}`;
  const login = (username, password) => fetch(`${base}/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username, password }) });
  console.log((await login('ben', 'nope')).status);
  const r = await login('ben', 'pw-ben');
  const cookie = r.headers.get('set-cookie');
  console.log(cookie.includes('HttpOnly'), cookie.includes('Secure'), cookie.includes('SameSite=Lax'));
  const sid = cookie.split(';')[0];
  console.log((await fetch(`${base}/account`)).status);
  console.log(await (await fetch(`${base}/account`, { headers: { Cookie: sid } })).text());
  console.log((await fetch(`${base}/admin`, { headers: { Cookie: sid } })).status);
  server.close();
});