Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#1219 Make 2FA tokens one-use only (#1848)

Browse Source 
- Make TotpAuthenticator keep track of the used codes and reject any known ones
This commit is contained in:
ljacqu
2019-07-06 18:26:43 +02:00
committed by Gabriele C
parent e2c2e8bead
commit 210a4f61cb
4 changed files with 56 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/fr/xephi/authme/security/totp/GenerateTotpServiceTest.java
+3 -3
View File
@@ -70,7 +70,7 @@ public class GenerateTotpServiceTest {
given(totpAuthenticator.generateTotpKey(player)).willReturn(givenGenerationResult);
generateTotpService.generateTotpKey(player);
String validCode = "928374";
given(totpAuthenticator.checkCode(generatedKey, validCode)).willReturn(true);
given(totpAuthenticator.checkCode("Aria", generatedKey, validCode)).willReturn(true);
// when
boolean invalidCodeResult = generateTotpService.isTotpCodeCorrectForGeneratedTotpKey(player, "000000");
@@ -81,8 +81,8 @@ public class GenerateTotpServiceTest {
assertThat(invalidCodeResult, equalTo(false));
assertThat(validCodeResult, equalTo(true));
assertThat(unknownPlayerResult, equalTo(false));
verify(totpAuthenticator).checkCode(generatedKey, "000000");
verify(totpAuthenticator).checkCode(generatedKey, validCode);
verify(totpAuthenticator).checkCode("Aria", generatedKey, "000000");
verify(totpAuthenticator).checkCode("Aria", generatedKey, validCode);
}
@Test
src/test/java/fr/xephi/authme/security/totp/TotpAuthenticatorTest.java
+27 -5
View File
@@ -1,9 +1,12 @@
package fr.xephi.authme.security.totp;
import com.google.common.collect.Table;
import com.warrenstrange.googleauth.IGoogleAuthenticator;
import fr.xephi.authme.ReflectionTestUtils;
import fr.xephi.authme.data.auth.PlayerAuth;
import fr.xephi.authme.security.totp.TotpAuthenticator.TotpGenerationResult;
import fr.xephi.authme.service.BukkitService;
import fr.xephi.authme.util.Utils;
import org.bukkit.entity.Player;
import org.junit.Before;
import org.junit.Test;
@@ -63,24 +66,26 @@ public class TotpAuthenticatorTest {
}
@Test
public void shouldCheckCode() {
public void shouldCheckCodeAndDeclareItValidOnlyOnce() {
// given
String secret = "the_secret";
int code = 21398;
given(googleAuthenticator.authorize(secret, code)).willReturn(true);
// when
boolean result = totpAuthenticator.checkCode(secret, Integer.toString(code));
boolean result1 = totpAuthenticator.checkCode("pl", secret, Integer.toString(code));
boolean result2 = totpAuthenticator.checkCode("pl", secret, Integer.toString(code));
// then
assertThat(result, equalTo(true));
assertThat(result1, equalTo(true));
assertThat(result2, equalTo(false));
verify(googleAuthenticator).authorize(secret, code);
}
@Test
public void shouldHandleInvalidNumberInput() {
// given / when
boolean result = totpAuthenticator.checkCode("Some_Secret", "123ZZ");
boolean result = totpAuthenticator.checkCode("foo", "Some_Secret", "123ZZ");
// then
assertThat(result, equalTo(false));
@@ -96,7 +101,7 @@ public class TotpAuthenticatorTest {
.totpKey(totpKey)
.build();
String inputCode = "408435";
given(totpAuthenticator.checkCode(totpKey, inputCode)).willReturn(true);
given(totpAuthenticator.checkCode("Maya", totpKey, inputCode)).willReturn(true);
// when
boolean result = totpAuthenticator.checkCode(auth, inputCode);
@@ -106,6 +111,23 @@ public class TotpAuthenticatorTest {
verify(googleAuthenticator).authorize(totpKey, 408435);
}
@Test
public void shouldRemoveOldEntries() {
// given
Table<String, Integer, Long> usedCodes = ReflectionTestUtils.getFieldValue(
TotpAuthenticator.class, totpAuthenticator, "usedCodes");
usedCodes.put("bobby", 414213, System.currentTimeMillis());
usedCodes.put("charlie", 732050, System.currentTimeMillis() - 6 * Utils.MILLIS_PER_MINUTE);
usedCodes.put("bobby", 236067, System.currentTimeMillis() - 9 * Utils.MILLIS_PER_MINUTE);
// when
totpAuthenticator.performCleanup();
// then
assertThat(usedCodes.size(), equalTo(1));
assertThat(usedCodes.contains("bobby", 414213), equalTo(true));
}
private final class TotpAuthenticatorTestImpl extends TotpAuthenticator {
TotpAuthenticatorTestImpl(BukkitService bukkitService) {