From 9577b5013ac385d523dba09147d1ca36184a013a Mon Sep 17 00:00:00 2001
From: Ben Adida <ben@adida.net>
Date: Tue, 20 Sep 2011 07:22:18 -0700
Subject: [PATCH] fixed calls to CA for expiration dates
---
browserid/lib/ca.js | 20 +++++++-----
browserid/lib/wsapi.js | 6 +++-
browserid/tests/ca-test.js | 4 ++-
verifier/lib/certassertion.js | 57 ++++++++++++++++++-----------------
4 files changed, 50 insertions(+), 37 deletions(-)
diff --git a/browserid/lib/ca.js b/browserid/lib/ca.js
index 9aee7cacf..2c4cee8d3 100644
--- a/browserid/lib/ca.js
+++ b/browserid/lib/ca.js
@@ -57,18 +57,22 @@ function parseCert(serializedCert) {
}
function certify(email, publicKey, expiration) {
- return new jwcert.JWCert(HOSTNAME, new Date(), publicKey, {email: email}).sign(secrets.SECRET_KEY);
+ if (expiration == null)
+ throw "expiration cannot be null";
+ return new jwcert.JWCert(HOSTNAME, expiration, publicKey, {email: email}).sign(secrets.SECRET_KEY);
}
function verifyChain(certChain, cb) {
// raw certs
- return jwcert.JWCert.verifyChain(certChain, function(issuer, next) {
- // for now we only do browserid.org issued keys
- if (issuer != HOSTNAME)
- return next(null);
-
- next(secrets.PUBLIC_KEY);
- }, cb);
+ return jwcert.JWCert.verifyChain(
+ certChain, new Date(),
+ function(issuer, next) {
+ // for now we only do browserid.org issued keys
+ if (issuer != HOSTNAME)
+ return next(null);
+
+ next(secrets.PUBLIC_KEY);
+ }, cb);
}
// exports, not the key stuff
diff --git a/browserid/lib/wsapi.js b/browserid/lib/wsapi.js
index c52ca3209..f26ea4822 100644
--- a/browserid/lib/wsapi.js
+++ b/browserid/lib/wsapi.js
@@ -303,7 +303,11 @@ function setup(app) {
var pk = ca.parsePublicKey(req.body.pubkey);
// same account, we certify the key
- var cert = ca.certify(req.body.email, pk);
+ // we certify it for a day for now
+ var expiration = new Date();
+ expiration.setTime(new Date().valueOf() + (24*3600*1000));
+ var cert = ca.certify(req.body.email, pk, expiration);
+
resp.writeHead(200, {'Content-Type': 'text/plain'});
resp.write(cert);
resp.end();
diff --git a/browserid/tests/ca-test.js b/browserid/tests/ca-test.js
index 2e9bdcd54..58841957a 100755
--- a/browserid/tests/ca-test.js
+++ b/browserid/tests/ca-test.js
@@ -61,7 +61,9 @@ var email_addr = "foo@foo.com";
suite.addBatch({
"certify a public key": {
topic: function() {
- return ca.certify(email_addr, kp.publicKey);
+ var expiration = new Date();
+ expiration.setTime(new Date().valueOf() + 5000);
+ return ca.certify(email_addr, kp.publicKey, expiration);
},
"parses" : function(cert_raw, err) {
var cert = ca.parseCert(cert_raw);
diff --git a/verifier/lib/certassertion.js b/verifier/lib/certassertion.js
index c2f88a1b8..30005bb0c 100644
--- a/verifier/lib/certassertion.js
+++ b/verifier/lib/certassertion.js
@@ -142,34 +142,37 @@ function verify(assertion, audience, successCB, errorCB, pkRetriever) {
var bundle = vep.unbundleCertsAndAssertion(assertion);
var theIssuer;
- jwcert.JWCert.verifyChain(bundle.certificates, function(issuer, next) {
- theIssuer = issuer;
- // allow other retrievers for testing
- if (pkRetriever)
- pkRetriever(issuer, next);
- else
- retrieveHostPublicKey(issuer, next, function(err) {next(null);});
- }, function(pk, principal) {
- // primary?
- if (theIssuer != configuration.get('hostname')) {
- // then the email better match the issuer
- if (!principal.email.match("@" + theIssuer + "$"))
+ jwcert.JWCert.verifyChain(
+ bundle.certificates,
+ new Date(), function(issuer, next) {
+ theIssuer = issuer;
+ // allow other retrievers for testing
+ if (pkRetriever)
+ pkRetriever(issuer, next);
+ else
+ retrieveHostPublicKey(issuer, next, function(err) {next(null);});
+ }, function(pk, principal) {
+ // primary?
+ if (theIssuer != configuration.get('hostname')) {
+ // then the email better match the issuer
+ console.log(principal);
+ if (!principal.email.match("@" + theIssuer + "$"))
+ return errorCB();
+ }
+
+ var tok = new jwt.JWT();
+ tok.parse(bundle.assertion);
+
+ // audience must match!
+ if (tok.audience != audience)
return errorCB();
- }
-
- var tok = new jwt.JWT();
- tok.parse(bundle.assertion);
-
- // audience must match!
- if (tok.audience != audience)
- return errorCB();
-
- if (tok.verify(pk)) {
- successCB(principal.email, tok.audience, tok.expires);
- } else {
- errorCB();
- }
- }, errorCB);
+
+ if (tok.verify(pk)) {
+ successCB(principal.email, tok.audience, tok.expires);
+ } else {
+ errorCB();
+ }
+ }, errorCB);
}
--
GitLab