bwilliams
eba6af680f
Without server.csrf.tokens.key, each server process signs CSRF tokens with a random key of its own, so tokens are lost on a restart and rejected by other instances. "job-search config generate-csrf-key" stores a new random 32-byte hex key in the configuration file, without printing it. --print only prints a key, for JOBSEARCH_SERVER_CSRF_TOKENS_KEY or another instance. An existing key is only replaced with --force, as that invalidates every issued token, and no key is stored while JOBSEARCH_SERVER_CSRF_TOKENS_KEY is set, as it would override the file.
130 lines
3.8 KiB
Go
130 lines
3.8 KiB
Go
package config
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"errors"
|
|
"fmt"
|
|
"log/slog"
|
|
"os"
|
|
|
|
"github.com/spf13/cobra"
|
|
"github.com/spf13/viper"
|
|
|
|
"git.avsdev.uk/Go/job-search/internal/cli"
|
|
"git.avsdev.uk/Go/job-search/internal/config"
|
|
)
|
|
|
|
// csrfKeySetting is the setting generate-csrf-key stores the key in.
|
|
const csrfKeySetting = "server.csrf.tokens.key"
|
|
|
|
// csrfKeyBytes is the length of a generated key: 32 bytes, as the server
|
|
// generates for itself when no key is set.
|
|
const csrfKeyBytes = 32
|
|
|
|
// commandGenerateCSRFKey returns the "config generate-csrf-key" command,
|
|
// which stores a new random CSRF key in the configuration file, or prints it.
|
|
func commandGenerateCSRFKey(opts *cli.Options) *cobra.Command {
|
|
cmd := &cobra.Command{
|
|
Use: "generate-csrf-key",
|
|
Args: cobra.NoArgs,
|
|
Short: "Generate a CSRF key and store it in the configuration file",
|
|
Long: `Generate a random key for signing CSRF tokens and store it in
|
|
server.csrf.tokens.key in the configuration file. Without a key, each server
|
|
process signs with a random key of its own, so tokens don't survive a restart
|
|
and aren't valid across instances. Give every instance the same key, and
|
|
restart them to use it.
|
|
|
|
The key isn't printed. With --print, it is only printed, and the
|
|
configuration file isn't changed: use that to set
|
|
JOBSEARCH_SERVER_CSRF_TOKENS_KEY instead, or another instance's file.
|
|
|
|
An existing key is only replaced with --force, as a new key invalidates
|
|
every token already issued. A key set by JOBSEARCH_SERVER_CSRF_TOKENS_KEY
|
|
overrides the file, so the command refuses to store one while it is set.`,
|
|
PersistentPreRun: func(cmd *cobra.Command, args []string) {
|
|
slog.Debug(
|
|
"command persistent pre-run", "command", "config.generate-csrf-key",
|
|
)
|
|
},
|
|
PersistentPostRun: func(cmd *cobra.Command, args []string) {
|
|
slog.Debug(
|
|
"command persistent post-run", "command", "config.generate-csrf-key",
|
|
)
|
|
},
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
slog.Debug("command run", "command", "config.generate-csrf-key")
|
|
|
|
printOnly, printErr := cmd.Flags().GetBool("print")
|
|
force, forceErr := cmd.Flags().GetBool("force")
|
|
err := errors.Join(printErr, forceErr)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
key := generateCSRFKey()
|
|
if printOnly {
|
|
fmt.Fprintln(cmd.OutOrStdout(), key) //nolint:errcheck // printing only
|
|
return nil
|
|
}
|
|
|
|
envVar := config.EnvVarName(csrfKeySetting)
|
|
if os.Getenv(envVar) != "" {
|
|
return fmt.Errorf(
|
|
"%s is set and overrides the configuration file: "+
|
|
"unset it first, or use --print to make a key for it",
|
|
envVar,
|
|
)
|
|
}
|
|
|
|
conf, err := opts.RunSetup(cmd, true, true)
|
|
if err != nil {
|
|
return fmt.Errorf("load configuration: %w", err)
|
|
}
|
|
if viper.ConfigFileUsed() == "" {
|
|
return errors.New("no configuration file exists")
|
|
}
|
|
if conf.Server.CSRF.Tokens.Key != "" && !force {
|
|
return fmt.Errorf(
|
|
"%s is already set: --force replaces it, which invalidates "+
|
|
"every token already issued",
|
|
csrfKeySetting,
|
|
)
|
|
}
|
|
|
|
_, _, err = config.StoreValue(conf, csrfKeySetting, key)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
fmt.Fprintf( //nolint:errcheck // printing only
|
|
cmd.OutOrStdout(),
|
|
"%s set in %s; restart the server to use it, and give every "+
|
|
"instance the same key\n",
|
|
csrfKeySetting,
|
|
viper.ConfigFileUsed(),
|
|
)
|
|
|
|
return nil
|
|
},
|
|
}
|
|
cmd.Flags().Bool(
|
|
"print", false, "only print the key; don't change the configuration file",
|
|
)
|
|
cmd.Flags().Bool(
|
|
"force", false, "replace an existing key, invalidating issued tokens",
|
|
)
|
|
cmd.MarkFlagsMutuallyExclusive("print", "force")
|
|
|
|
return cmd
|
|
}
|
|
|
|
// generateCSRFKey returns a new random key, hex encoded as
|
|
// server.csrf.tokens.key expects.
|
|
func generateCSRFKey() string {
|
|
key := make([]byte, csrfKeyBytes)
|
|
rand.Read(key) // crypto/rand.Read never returns an error
|
|
|
|
return hex.EncodeToString(key)
|
|
}
|