Revert "uberf-9797: idp auth state (#9196)" (#9236)

This reverts commit 95b7fccca2.

Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com>

pods/authProviders/src/github.ts

@@ -4,13 +4,7 @@ import { BrandingMap, concatLink, MeasureContext, getBranding, SocialIdType } fr
 import Router from 'koa-router'
 import { Strategy as GitHubStrategy } from 'passport-github2'
 import { Passport } from '.'
-import {
-  encodeState,
-  handleProviderAuth,
-  safeParseAuthState,
-  setAuthStateTokenCookie,
-  validateAuthStateTokenCookie
-} from './utils'
+import { encodeState, handleProviderAuth, safeParseAuthState } from './utils'
 
 export function registerGithub (
   measureCtx: MeasureContext,
@@ -45,11 +39,7 @@ export function registerGithub (
 
   router.get('/auth/github', async (ctx, next) => {
     measureCtx.info('try auth via', { provider: 'github' })
-
-    const nonce = crypto.randomUUID()
-    setAuthStateTokenCookie(ctx, nonce)
-
-    const state = encodeState(ctx, brandings, nonce)
+    const state = encodeState(ctx, brandings)
 
     passport.authenticate('github', { scope: ['user:email'], session: true, state })(ctx, next)
   })
@@ -59,15 +49,9 @@ export function registerGithub (
     async (ctx, next) => {
       const state = safeParseAuthState(ctx.query?.state)
       const branding = getBranding(brandings, state?.branding)
-      const loginUrl = concatLink(branding?.front ?? frontUrl, '/login')
-      const isValidState = validateAuthStateTokenCookie(ctx, state?.nonce)
-      if (!isValidState) {
-        ctx.redirect(loginUrl)
-        return
-      }
 
       await passport.authenticate('github', {
-        failureRedirect: loginUrl,
+        failureRedirect: concatLink(branding?.front ?? frontUrl, '/login'),
         session: true
       })(ctx, next)
     },

pods/authProviders/src/google.ts

@@ -4,13 +4,7 @@ import { BrandingMap, concatLink, MeasureContext, getBranding, SocialIdType } fr
 import Router from 'koa-router'
 import { Strategy as GoogleStrategy } from 'passport-google-oauth20'
 import { Passport } from '.'
-import {
-  encodeState,
-  handleProviderAuth,
-  safeParseAuthState,
-  setAuthStateTokenCookie,
-  validateAuthStateTokenCookie
-} from './utils'
+import { encodeState, handleProviderAuth, safeParseAuthState } from './utils'
 
 export function registerGoogle (
   measureCtx: MeasureContext,
@@ -45,11 +39,7 @@ export function registerGoogle (
 
   router.get('/auth/google', async (ctx, next) => {
     measureCtx.info('try auth via', { provider: 'google' })
-
-    const nonce = crypto.randomUUID()
-    setAuthStateTokenCookie(ctx, nonce)
-
-    const state = encodeState(ctx, brandings, nonce)
+    const state = encodeState(ctx, brandings)
 
     passport.authenticate('google', { scope: ['profile', 'email'], session: true, state })(ctx, next)
   })
@@ -58,17 +48,13 @@ export function registerGoogle (
     redirectURL,
     async (ctx, next) => {
       const state = safeParseAuthState(ctx.query?.state)
+      measureCtx.info('Auth state', { state })
       const branding = getBranding(brandings, state?.branding)
-
-      const loginUrl = concatLink(branding?.front ?? frontUrl, '/login')
-      const isValidState = validateAuthStateTokenCookie(ctx, state?.nonce)
-      if (!isValidState) {
-        ctx.redirect(loginUrl)
-        return
-      }
-
+      measureCtx.info('With branding', { branding })
+      const failureRedirect = concatLink(branding?.front ?? frontUrl, '/login')
+      measureCtx.info('With failure redirect', { failureRedirect })
       await passport.authenticate('google', {
-        failureRedirect: loginUrl,
+        failureRedirect,
         session: true
       })(ctx, next)
     },

pods/authProviders/src/openid.ts

@@ -19,13 +19,7 @@ import Router from 'koa-router'
 import { Issuer, Strategy } from 'openid-client'
 
 import { Passport } from '.'
-import {
-  encodeState,
-  handleProviderAuth,
-  safeParseAuthState,
-  setAuthStateTokenCookie,
-  validateAuthStateTokenCookie
-} from './utils'
+import { encodeState, handleProviderAuth, safeParseAuthState } from './utils'
 
 export function registerOpenid (
   measureCtx: MeasureContext,
@@ -72,11 +66,7 @@ export function registerOpenid (
 
   router.get('/auth/openid', async (ctx, next) => {
     measureCtx.info('try auth via', { provider: 'openid' })
-
-    const nonce = crypto.randomUUID()
-    setAuthStateTokenCookie(ctx, nonce)
-
-    const state = encodeState(ctx, brandings, nonce)
+    const state = encodeState(ctx, brandings)
 
     await passport.authenticate('oidc', {
       scope: 'openid profile email',
@@ -89,15 +79,9 @@ export function registerOpenid (
     async (ctx, next) => {
       const state = safeParseAuthState(ctx.query?.state)
       const branding = getBranding(brandings, state?.branding)
-      const loginUrl = concatLink(branding?.front ?? frontUrl, '/login')
-      const isValidState = validateAuthStateTokenCookie(ctx, state?.nonce)
-      if (!isValidState) {
-        ctx.redirect(loginUrl)
-        return
-      }
 
       await passport.authenticate('oidc', {
-        failureRedirect: loginUrl
+        failureRedirect: concatLink(branding?.front ?? frontUrl, '/login')
       })(ctx, next)
     },
     async (ctx, next) => {

pods/authProviders/src/utils.ts

@@ -32,7 +32,6 @@ export interface AuthState {
   branding?: string
   autoJoin?: boolean
   navigateUrl?: string
-  nonce?: string
 }
 
 export function safeParseAuthState (rawState: string | undefined): AuthState {
@@ -47,15 +46,14 @@ export function safeParseAuthState (rawState: string | undefined): AuthState {
   }
 }
 
-export function encodeState (ctx: any, brandings: BrandingMap, nonce: string): string {
+export function encodeState (ctx: any, brandings: BrandingMap): string {
   const host = getHost(ctx.request.headers)
   const branding = host !== undefined ? brandings[host]?.key ?? undefined : undefined
   const state: AuthState = {
     inviteId: ctx.query?.inviteId,
     branding,
     autoJoin: ctx.query?.autoJoin !== undefined,
-    navigateUrl: ctx.query?.navigateUrl,
-    nonce
+    navigateUrl: ctx.query?.navigateUrl
   }
 
   return encodeURIComponent(JSON.stringify(state))
@@ -133,26 +131,3 @@ export async function handleProviderAuth (
     return ''
   }
 }
-
-const authStateTokenCookie = 'auth_state_token'
-
-export function setAuthStateTokenCookie (ctx: any, nonce: string): void {
-  ctx.cookies.set(authStateTokenCookie, nonce, {
-    httpOnly: true, // Prevents JavaScript access to cookie
-    secure: true, // Only sent over HTTPS connections
-    sameSite: 'lax', // Prevents CSRF by controlling when cookie is sent cross-site
-    signed: true, // Signs cookie with app.keys to prevent tampering
-    maxAge: 10 * 60 * 1000 // 10 minutes
-  })
-}
-
-export function validateAuthStateTokenCookie (ctx: any, expectedNonce: string | undefined): boolean {
-  const nonce = ctx.cookies.get(authStateTokenCookie)
-  ctx.cookies.set(authStateTokenCookie, null)
-
-  if (nonce === undefined || expectedNonce === undefined || nonce !== expectedNonce) {
-    return false
-  }
-
-  return true
-}