mirrors/vector-im-hydrogen-web
1
0
Fork 0
mirror of https://github.com/vector-im/hydrogen-web.git synced 2024-11-20 11:36:24 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #1189 from element-hq/midhun/auth-media/token

Browse Source 
Only send token after verifying the homeserver
This commit is contained in:
R Midhun Suresh 2024-10-21 14:44:06 +05:30 committed by GitHub
commit 49263a7981
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 45 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/matrix/Client.js
View File

@ -290,8 +290,11 @@ export class Client {
serverVersions: lastVersionsResponse.versions,
});
// Let the serviceWorkerHandler know of this access-token
this._platform.updateService.setAccessToken(sessionInfo.accessToken);
// Let the serviceWorkerHandler know of this access-token and homeserver
this._platform.updateService.updateAuthData({
accessToken: sessionInfo.accessToken,
homeserver: sessionInfo.homeServer,
});
this._session = new Session({
storage: this._storage,
@ -382,7 +385,9 @@ export class Client {
throw Error("No session loaded, cannot update access token");
}
this._session.updateAccessToken(token);
await this._platform.updateService.setAccessToken(token);
this._platform.updateService.updateAuthData({
accessToken: token,
});
await this._platform.sessionInfoStorage.updateAccessToken(this._sessionId, token);
}

19
src/platform/web/dom/ServiceWorkerHandler.js
View File

@ -28,7 +28,7 @@ export class ServiceWorkerHandler {
this._currentController = null;
this._sessionInfoStorage = sessionInfoStorage;
this.haltRequests = false;
this._accessToken = null;
this._authData = {};
}
setNavigation(navigation) {
@ -36,11 +36,16 @@ export class ServiceWorkerHandler {
}
/**
* Set the access-token to be used within the service worker.
* @param token An access-token
* Set the access-token and homeserver to be used within the service worker.
* @param auth An object with accessToken and homeserver
*/
setAccessToken(token) {
this._accessToken = token;
updateAuthData(auth) {
if (!auth.accessToken && !auth.homeserver) {
throw new Error(
"updateAuthData argument must contain accessToken, homeserver or both!"
);
}
this._authData = { ...this._authData, ...auth };
}
registerAndStart(path) {
@ -96,10 +101,10 @@ export class ServiceWorkerHandler {
event.source.postMessage({ replyTo: data.id });
} else if (data.type === "openRoom") {
this._navigation.push("room", data.payload.roomId);
} else if (data.type === "getAccessToken") {
} else if (data.type === "getAuthInfo") {
event.source.postMessage({
replyTo: data.id,
payload: this._accessToken,
payload: this._authData,
});
}
}

36
src/platform/web/sw.js
View File

@ -124,25 +124,39 @@ async function handleRequest({ request, clientId }) {
}
// Add access token for authenticated media endpoints
if (request.url.includes("_matrix/client/v1/media")) {
const headers = new Headers(request.headers);
const pathNameStartsWithMediaPrefix =
url.pathname.indexOf("/_matrix/client/v1/media") === 0;
if (pathNameStartsWithMediaPrefix) {
const client = await self.clients.get(clientId);
const accessToken = await sendAndWaitForReply(
const { accessToken, homeserver } = await sendAndWaitForReply(
client,
"getAccessToken",
"getAuthInfo",
{}
);
if (!accessToken) {
throw new Error(
"Token returned from getAccessToken message in sw.js is null"
"Token returned from getAuthInfo message in sw.js is null!"
);
}
headers.set("authorization", `Bearer ${accessToken}`);
request = new Request(request, {
mode: "cors",
credentials: "omit",
headers,
});
if (!homeserver) {
throw new Error(
"homeserver returned from getAuthInfo message in sw.js is null!"
);
}
// Is this request actually going to the homeserver?
const isRequestForHomeserver =
new URL(homeserver).origin === url.origin;
if (isRequestForHomeserver) {
// Only add the access-token if we know that this request
// is going to the homeserver.
const headers = new Headers(request.headers);
headers.set("authorization", `Bearer ${accessToken}`);
request = new Request(request, {
mode: "cors",
credentials: "omit",
headers,
});
}
}
let response = await readCache(request);