diff --git a/bin/browserid b/bin/browserid
index 6f23273cbcb5e5c86adc231d3831e548b7175c6b..03fa955e44d9c29e754dee7b3bc5721ec32c2155 100755
--- a/bin/browserid
+++ b/bin/browserid
@@ -24,7 +24,7 @@ config = require('../lib/configuration.js'),
heartbeat = require('../lib/heartbeat.js'),
metrics = require('../lib/metrics.js'),
logger = require('../lib/logging.js').logger,
-forward = require('../lib/http_forward'),
+forward = require('../lib/http_forward').forward,
shutdown = require('../lib/shutdown'),
views = require('../lib/browserid/views.js');
diff --git a/bin/proxy b/bin/proxy
index 02b2da157cdbf29799957d5d764aec5cdf2e45ce..ce26d11277480ae7ea312db34bcf5c17da061a24 100755
--- a/bin/proxy
+++ b/bin/proxy
@@ -14,6 +14,9 @@ config = require('../lib/configuration.js');
var port = config.has('bind_to.port') ? config.get('bind_to.port') : 0;
var addy = config.has('bind_to.host') ? config.get('bind_to.host') : "127.0.0.1";
+// set a maximum allowed time on responses to declaration of support requests
+forward.setTimeout(config.get('declaration_of_support_timeout_ms'));
+
const allowed = /^https:\/\/[a-zA-Z0-9\.\-_]+\/\.well-known\/browserid$/;
var server = http.createServer(function (req, res) {
@@ -24,7 +27,7 @@ var server = http.createServer(function (req, res) {
return;
}
- forward(url, req, res, function(err) {
+ forward.forward(url, req, res, function(err) {
if (err) {
res.writeHead(400);
res.end('Oops: ' + err.toString());
diff --git a/lib/configuration.js b/lib/configuration.js
index 8ba0fabc93cc20943e9df3bc9d10cda75c97c627..c414472c78173816225ce90a4ee205e79d0a3618 100644
--- a/lib/configuration.js
+++ b/lib/configuration.js
@@ -187,7 +187,11 @@ var conf = module.exports = convict({
env: 'DBWRITER_URL'
},
process_type: 'string',
- email_to_console: 'boolean = false'
+ email_to_console: 'boolean = false',
+ declaration_of_support_timeout_ms: {
+ doc: "The amount of time we wait for a server to respond with a declaration of support, before concluding that they are not a primary. Only relevant when our local proxy is in use, not in production or staging",
+ format: 'integer = 15000'
+ }
});
// At the time this file is required, we'll determine the "process name" for this proc
diff --git a/lib/http_forward.js b/lib/http_forward.js
index 5277aa95643a31659a9a45085902e5b31cc37065..d88cbd85de18c4f97f85fbb563fc0929dc05c30d 100644
--- a/lib/http_forward.js
+++ b/lib/http_forward.js
@@ -9,7 +9,21 @@ https = require('https'),
logger = require('./logging.js').logger,
querystring = require('querystring');
-module.exports = function(dest, req, res, cb) {
+var global_forward_timeout = undefined;
+
+exports.setTimeout = function(to) {
+ if (typeof to != 'number') throw "setTimeout expects a numeric argument";
+ global_forward_timeout = to;
+};
+
+exports.forward = function(dest, req, res, cb) {
+ var _cb = cb;
+ var requestTimeout = undefined;
+ cb = function() {
+ if (requestTimeout) clearTimeout(requestTimeout);
+ if (_cb) _cb.apply(null, arguments);
+ }
+
function cleanupReq() {
if (preq) {
preq.removeAllListeners();
@@ -56,6 +70,10 @@ module.exports = function(dest, req, res, cb) {
cb(e);
});
+ if (global_forward_timeout) {
+ requestTimeout = setTimeout(function() { preq.destroy(); }, global_forward_timeout);
+ }
+
if (req.headers['content-type']) {
preq.setHeader('Content-Type', req.headers['content-type']);
}
diff --git a/lib/primary.js b/lib/primary.js
index 060d199cca3fb1a6c327d9b9aba3a0ad197bc5c0..5a450042b0ec25b4f7ce546e1670beea4c320c21 100644
--- a/lib/primary.js
+++ b/lib/primary.js
@@ -187,7 +187,7 @@ exports.checkSupport = function(domain, cb, delegates) {
if (typeof domain !== 'string' || !domain.length) {
return process.nextTick(function() { cb("invalid domain"); });
}
- getWellKnown(domain, delegates, function (err, body, domain, delegates) {
+ getWellKnown(domain, delegates, function (err, body, domain, cbdelegates) {
if (err) {
logger.debug(err);
return cb(err);
@@ -197,7 +197,7 @@ exports.checkSupport = function(domain, cb, delegates) {
}
try {
- var r = parseWellKnownBody(body, domain, delegates, function (err, r) {
+ var r = parseWellKnownBody(body, domain, cbdelegates, function (err, r) {
if (err) {
logger.debug(err);
cb(err);
@@ -227,6 +227,18 @@ exports.getPublicKey = function(domain, cb) {
});
};
+// Does emailDomain actual delegate to the issuingDomain?
+exports.delegatesAuthority = function (emailDomain, issuingDomain, cb) {
+ exports.checkSupport(emailDomain, function(err, urls, publicKey) {
+ // Check http or https://{issuingDomain}/some/sign_in_path
+ if (! err && urls && urls.auth &&
+ urls.auth.indexOf('://' + issuingDomain + '/') !== -1) {
+ cb(true);
+ }
+ cb(false);
+ });
+}
+
// verify an assertion generated to authenticate to browserid
exports.verifyAssertion = function(assertion, cb) {
if (config.get('disable_primary_support')) {
diff --git a/lib/verifier/certassertion.js b/lib/verifier/certassertion.js
index 42816d69830de1f4fc12937d7b83957c4c192a50..a8342f3160b2737490c3b0312e5830f4777611f8 100644
--- a/lib/verifier/certassertion.js
+++ b/lib/verifier/certassertion.js
@@ -118,7 +118,7 @@ function verify(assertion, audience, successCB, errorCB) {
});
}, function(err, certParamsArray, payload, assertionParams) {
if (err) return errorCB(err);
-
+
// audience must match!
var err = compareAudiences(assertionParams.audience, audience)
if (err) {
@@ -129,18 +129,24 @@ function verify(assertion, audience, successCB, errorCB) {
// principal is in the last cert
var principal = certParamsArray[certParamsArray.length - 1].certParams.principal;
-
- // verify that the issuer is the same as the email domain
- // NOTE: for "delegation of authority" support we'll need to make this check
- // more sophisticated
+
+ // verify that the issuer is the same as the email domain or
+ // that the email's domain delegated authority to the issuer
var domainFromEmail = principal.email.replace(/^.*@/, '');
+
if (ultimateIssuer != HOSTNAME && ultimateIssuer !== domainFromEmail)
{
- return errorCB("issuer '" + ultimateIssuer + "' may not speak for emails from '"
- + domainFromEmail + "'");
+ primary.delegatesAuthority(domainFromEmail, ultimateIssuer, function (delegated) {
+ if (delegated) {
+ return successCB(principal.email, assertionParams.audience, assertionParams.expiresAt, ultimateIssuer);
+ } else {
+ return errorCB("issuer '" + ultimateIssuer + "' may not speak for emails from '"
+ + domainFromEmail + "'");
+ }
+ });
+ } else {
+ return successCB(principal.email, assertionParams.audience, assertionParams.expiresAt, ultimateIssuer);
}
-
- successCB(principal.email, assertionParams.audience, assertionParams.expiresAt, ultimateIssuer);
}, errorCB);
};
diff --git a/lib/wsapi.js b/lib/wsapi.js
index c76c7e3e23bf501492316c40eb4dcf1b3a4c4c0a..7b736425feb5113c86a8f8d9ca91fddfe3204e87 100644
--- a/lib/wsapi.js
+++ b/lib/wsapi.js
@@ -22,7 +22,7 @@ secrets = require('./secrets'),
config = require('./configuration'),
logger = require('./logging.js').logger,
httputils = require('./httputils.js'),
-forward = require('./http_forward.js'),
+forward = require('./http_forward.js').forward,
url = require('url'),
fs = require('fs'),
path = require('path'),
diff --git a/lib/wsapi/address_info.js b/lib/wsapi/address_info.js
index c1d734bdb4269fae0b2ec62d9688b9d3e6ade1c4..778bd4291953da0cc9af22988a039bd80e67cab3 100644
--- a/lib/wsapi/address_info.js
+++ b/lib/wsapi/address_info.js
@@ -31,7 +31,7 @@ exports.process = function(req, res) {
return httputils.badRequest(res, "invalid email address");
}
- primary.checkSupport(m[1], function(err, urls, publicKey) {
+ primary.checkSupport(m[1], function(err, urls, publicKey, delegates) {
if (err) {
logger.warn('error checking "' + m[1] + '" for primary support: ' + err);
return httputils.serverError(res, "can't check email address");
diff --git a/lib/wsapi/cert_key.js b/lib/wsapi/cert_key.js
index 777d61223b6732ab620c66325baa9975eac891f5..0f0c81ef3f8d7336db02f0ad90a6719fcc086957 100644
--- a/lib/wsapi/cert_key.js
+++ b/lib/wsapi/cert_key.js
@@ -6,7 +6,7 @@ const
db = require('../db.js'),
httputils = require('../httputils'),
logger = require('../logging.js').logger,
-forward = require('../http_forward.js'),
+forward = require('../http_forward.js').forward,
config = require('../configuration.js'),
urlparse = require('urlparse'),
wsapi = require('../wsapi.js');
diff --git a/resources/static/pages/start.js b/resources/static/pages/start.js
index f53a9cdb23441c947f629b9f9a835d011b425cbb..e43661c6d51a1cbff4ec3f7af807fc2dd271ddf4 100644
--- a/resources/static/pages/start.js
+++ b/resources/static/pages/start.js
@@ -80,7 +80,7 @@ $(function() {
verifyFunction: "verifyEmail"
});
}
- else if(token && path === "/verify_email_address") {
+ else if(path === "/verify_email_address") {
var module = bid.verifySecondaryAddress.create();
module.start({
token: token,
diff --git a/resources/static/shared/network.js b/resources/static/shared/network.js
index b56ef5684c9e539ba1b9ef0069fe15f51b4df948..db6b60890bfbfb03938a60eabad7d131e378d602 100644
--- a/resources/static/shared/network.js
+++ b/resources/static/shared/network.js
@@ -640,7 +640,10 @@ BrowserID.Network = (function() {
withContext(function() {
try {
// set a test cookie with a duration of 1 second.
- // NOTE - The Android 3.3 default browser will still pass this.
+ // NOTE - The Android 3.3 and 4.0 default browsers will still pass
+ // this check. This causes the Android browsers to only display the
+ // cookies diabled error screen only after the user has entered and
+ // submitted input.
// http://stackoverflow.com/questions/8509387/android-browser-not-respecting-cookies-disabled/9264996#9264996
document.cookie = "test=true; max-age=1";
var enabled = document.cookie.indexOf("test") > -1;