Phase 5: CSRF, bcrypt hashing, audit logging, export re-auth
- Add CSRF token per session, validated on all state-changing requests (POST/PUT/DELETE) - Upgrade password hashing from PBKDF2 to bcrypt; auto-upgrade old hashes on login - Add audit_log table tracking all security events (login, export, delete, etc.) - Add /reauth endpoint requiring master password before export - Client-side: re-auth modal before export, X-CSRF-Token header on mutations
This commit is contained in:
@@ -1,5 +1,6 @@
|
||||
const API = '/password-manager/api.php';
|
||||
let token = sessionStorage.getItem('authToken');
|
||||
let csrfToken = sessionStorage.getItem('csrfToken') || '';
|
||||
let curUser = sessionStorage.getItem('currentUsername');
|
||||
let view = localStorage.getItem('vaultView') || 'grid';
|
||||
let showView = localStorage.getItem('showViewBtn') !== 'false';
|
||||
@@ -157,7 +158,7 @@ async function addFolderToServer(name) {
|
||||
try {
|
||||
const r = await fetch(API + '/folders', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken },
|
||||
body: JSON.stringify({ name })
|
||||
});
|
||||
if (r.ok) { await loadFolders(); return true; }
|
||||
@@ -171,7 +172,7 @@ async function deleteFolderFromServer(name) {
|
||||
try {
|
||||
const r = await fetch(API + '/folders/' + encodeURIComponent(name), {
|
||||
method: 'DELETE',
|
||||
headers: { 'Authorization': 'Bearer ' + token }
|
||||
headers: { 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken }
|
||||
});
|
||||
if (r.ok) {
|
||||
await loadFolders();
|
||||
@@ -251,15 +252,15 @@ function toggleTrash() {
|
||||
playSound('click');
|
||||
}
|
||||
async function restoreEntry(id) {
|
||||
try { const r = await fetch(API + '/entries/' + id + '/restore', { method: 'POST', headers: { 'Authorization': 'Bearer ' + token } }); if (r.ok) { toast('✅ Restored!'); await loadEntries(); playSound('success'); } } catch (e) { toast('⚠️ Error', 'error'); }
|
||||
try { const r = await fetch(API + '/entries/' + id + '/restore', { method: 'POST', headers: { 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken } }); if (r.ok) { toast('✅ Restored!'); await loadEntries(); playSound('success'); } } catch (e) { toast('⚠️ Error', 'error'); }
|
||||
}
|
||||
async function permanentDelete(id) {
|
||||
if (!confirm('Permanently delete?')) return;
|
||||
try { const r = await fetch(API + '/entries/' + id + '?permanent=1', { method: 'DELETE', headers: { 'Authorization': 'Bearer ' + token } }); if (r.ok) { toast('🗑️ Permanently deleted'); await loadEntries(); playSound('error'); } } catch (e) { toast('⚠️ Error', 'error'); }
|
||||
try { const r = await fetch(API + '/entries/' + id + '?permanent=1', { method: 'DELETE', headers: { 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken } }); if (r.ok) { toast('🗑️ Permanently deleted'); await loadEntries(); playSound('error'); } } catch (e) { toast('⚠️ Error', 'error'); }
|
||||
}
|
||||
async function emptyTrash() {
|
||||
if (!confirm('Delete ALL trashed entries?')) return;
|
||||
try { const r = await fetch(API + '/entries/trash/empty', { method: 'DELETE', headers: { 'Authorization': 'Bearer ' + token } }); if (r.ok) { toast('🗑️ Trash emptied'); await loadEntries(); playSound('error'); } } catch (e) { toast('⚠️ Error', 'error'); }
|
||||
try { const r = await fetch(API + '/entries/trash/empty', { method: 'DELETE', headers: { 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken } }); if (r.ok) { toast('🗑️ Trash emptied'); await loadEntries(); playSound('error'); } } catch (e) { toast('⚠️ Error', 'error'); }
|
||||
}
|
||||
function timeAgo(dateStr) {
|
||||
if (!dateStr) return '';
|
||||
@@ -389,10 +390,11 @@ async function login() {
|
||||
const r = await fetch(API + '/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username: u, masterPassword: p }) });
|
||||
const d = await r.json();
|
||||
if (r.ok) {
|
||||
token = d.token; curUser = u;
|
||||
token = d.token; csrfToken = d.csrfToken || ''; curUser = u;
|
||||
cryptoKey = await deriveKey(p, d.salt);
|
||||
persistCryptoKey();
|
||||
sessionStorage.setItem('authToken', token);
|
||||
sessionStorage.setItem('csrfToken', csrfToken);
|
||||
sessionStorage.setItem('currentUsername', u);
|
||||
await loadFolders();
|
||||
toast('✅ Login!');
|
||||
@@ -414,10 +416,11 @@ async function register() {
|
||||
const r = await fetch(API + '/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username: u, masterPassword: p }) });
|
||||
const d = await r.json();
|
||||
if (r.ok) {
|
||||
token = d.token; curUser = u;
|
||||
token = d.token; csrfToken = d.csrfToken || ''; curUser = u;
|
||||
cryptoKey = await deriveKey(p, d.salt);
|
||||
persistCryptoKey();
|
||||
sessionStorage.setItem('authToken', token);
|
||||
sessionStorage.setItem('csrfToken', csrfToken);
|
||||
sessionStorage.setItem('currentUsername', u);
|
||||
await loadFolders();
|
||||
toast('✅ Created!');
|
||||
@@ -432,11 +435,11 @@ async function register() {
|
||||
async function doLogout() {
|
||||
saveUsername();
|
||||
if (token) {
|
||||
try { await fetch(API + '/logout', { method: 'POST', headers: { 'Authorization': 'Bearer ' + token } }); } catch (e) {}
|
||||
try { await fetch(API + '/logout', { method: 'POST', headers: { 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken } }); } catch (e) {}
|
||||
}
|
||||
clearTimeout(idleT); clearTimeout(warnT); clearInterval(countT);
|
||||
document.getElementById('idleWarning').classList.remove('show');
|
||||
token = null; curUser = null; entries = []; cryptoKey = null; folders = ['All']; showTrash = false;
|
||||
token = null; csrfToken = ''; curUser = null; entries = []; cryptoKey = null; folders = ['All']; showTrash = false;
|
||||
sessionStorage.clear();
|
||||
document.getElementById('authSection').classList.remove('hidden');
|
||||
document.getElementById('vaultSection').classList.add('hidden');
|
||||
@@ -739,7 +742,7 @@ async function saveEdit() {
|
||||
if (!site || !password) { toast('Site and password required', 'error'); return; }
|
||||
try {
|
||||
const enc = await encryptPwd(password);
|
||||
const r = await fetch(API + '/entries/' + id, { method: 'PUT', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token }, body: JSON.stringify({ site, username, encrypted_password: enc.encrypted, iv: enc.iv, folder }) });
|
||||
const r = await fetch(API + '/entries/' + id, { method: 'PUT', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken }, body: JSON.stringify({ site, username, encrypted_password: enc.encrypted, iv: enc.iv, folder }) });
|
||||
if (r.ok) { toast('✅ Updated!'); closeEdit(); loadEntries(); playSound('success'); }
|
||||
else { const d = await r.json(); toast('❌ ' + (d.error || 'Failed'), 'error'); }
|
||||
} catch (e) { toast('⚠️ Error', 'error'); }
|
||||
@@ -827,7 +830,7 @@ async function batchMove() {
|
||||
const enc = await encryptPwd(e.password);
|
||||
await fetch(API + '/entries/' + id, {
|
||||
method: 'PUT',
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken },
|
||||
body: JSON.stringify({ site: e.site, username: e.username, encrypted_password: enc.encrypted, iv: enc.iv, folder })
|
||||
});
|
||||
}
|
||||
@@ -850,7 +853,7 @@ async function addEntry() {
|
||||
const folder = document.getElementById('addFolder').value;
|
||||
const r = await fetch(API + '/entries', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken },
|
||||
body: JSON.stringify({ site, username: user, encrypted_password: enc.encrypted, iv: enc.iv, encryption_method: 'client', folder })
|
||||
});
|
||||
if (r.ok) {
|
||||
@@ -867,7 +870,7 @@ async function addEntry() {
|
||||
}
|
||||
async function delEntry(id) {
|
||||
try {
|
||||
const r = await fetch(API + '/entries/' + id, { method: 'DELETE', headers: { 'Authorization': 'Bearer ' + token } });
|
||||
const r = await fetch(API + '/entries/' + id, { method: 'DELETE', headers: { 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken } });
|
||||
if (r.ok) { order = order.filter(x => x != id); localStorage.setItem('entryOrder', JSON.stringify(order)); toast('📦 Moved to trash'); await loadEntries(); playSound('delete'); }
|
||||
} catch (e) { toast('Error', 'error'); }
|
||||
}
|
||||
@@ -879,7 +882,39 @@ function searchEntries() {
|
||||
if (btn) btn.style.display = input.value.trim() ? 'block' : 'none';
|
||||
loadEntries(input.value);
|
||||
}
|
||||
function exportPasswords() { if (!confirm('Export plain text?')) return; const b = new Blob([JSON.stringify(entries, null, 2)], { type: 'application/json' }); const a = document.createElement('a'); a.href = URL.createObjectURL(b); a.download = 'vault-' + new Date().toISOString().slice(0, 10) + '.json'; a.click(); URL.revokeObjectURL(a.href); toast('Exported!'); }
|
||||
function showExportModal() {
|
||||
const overlay = document.createElement('div');
|
||||
overlay.className = 'custom-modal-overlay show';
|
||||
overlay.innerHTML = `<div class="custom-modal"><h3>📤 Export Passwords</h3><p style="color:var(--text2);margin-bottom:1rem;">Re-enter master password to export plaintext passwords</p><input type="password" id="exportPassword" placeholder="Master password" style="width:100%"><div class="modal-actions" style="margin-top:1rem"><button class="btn btn-outline btn-sm" id="cancelExport">Cancel</button><button class="btn btn-sm" id="confirmExport">Export</button></div></div>`;
|
||||
document.body.appendChild(overlay);
|
||||
document.getElementById('cancelExport').onclick = () => overlay.remove();
|
||||
document.getElementById('confirmExport').onclick = async () => {
|
||||
const pwd = document.getElementById('exportPassword').value;
|
||||
if (!pwd) { toast('Enter your master password', 'error'); return; }
|
||||
try {
|
||||
const r = await fetch(API + '/reauth', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token, 'X-CSRF-Token': csrfToken },
|
||||
body: JSON.stringify({ masterPassword: pwd })
|
||||
});
|
||||
if (r.ok) {
|
||||
overlay.remove();
|
||||
const b = new Blob([JSON.stringify(entries, null, 2)], { type: 'application/json' });
|
||||
const a = document.createElement('a');
|
||||
a.href = URL.createObjectURL(b);
|
||||
a.download = 'vault-' + new Date().toISOString().slice(0, 10) + '.json';
|
||||
a.click();
|
||||
URL.revokeObjectURL(a.href);
|
||||
toast('Exported!');
|
||||
playSound('success');
|
||||
} else {
|
||||
toast('❌ Invalid password', 'error');
|
||||
}
|
||||
} catch (e) { toast('⚠️ Error', 'error'); }
|
||||
};
|
||||
overlay.addEventListener('click', (e) => { if (e.target === overlay) overlay.remove(); });
|
||||
playSound('open');
|
||||
}
|
||||
function esc(t) { const d = document.createElement('div'); d.textContent = t; return d.innerHTML; }
|
||||
function clearSearch() {
|
||||
const input = document.getElementById('searchInput');
|
||||
|
||||
Reference in New Issue
Block a user