paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
112 lines
3.2 KiB
JavaScript
112 lines
3.2 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Test script to verify authentication security enhancements
|
|
*/
|
|
|
|
console.log('=== Testing Authentication Security Enhancements ===\n');
|
|
|
|
const {
|
|
checkAccountLockout,
|
|
getGenericAuthError,
|
|
MAX_LOGIN_ATTEMPTS,
|
|
LOCKOUT_DURATION
|
|
} = require('../src/utils/authSecurity');
|
|
|
|
let passed = 0;
|
|
let failed = 0;
|
|
|
|
function test(description, fn) {
|
|
try {
|
|
const result = fn();
|
|
if (result || result === undefined) {
|
|
console.log(`✅ ${description}`);
|
|
passed++;
|
|
} else {
|
|
console.log(`❌ ${description}`);
|
|
failed++;
|
|
}
|
|
} catch (error) {
|
|
console.log(`❌ ${description} - Error: ${error.message}`);
|
|
failed++;
|
|
}
|
|
}
|
|
|
|
// Test generic error message
|
|
console.log('Testing generic error messages:');
|
|
test('Generic error prevents user enumeration', () => {
|
|
const error = getGenericAuthError();
|
|
return error === 'Invalid credentials';
|
|
});
|
|
|
|
// Test constants
|
|
console.log('\nTesting security constants:');
|
|
test('Max login attempts is reasonable', () => MAX_LOGIN_ATTEMPTS === 5);
|
|
test('Lockout duration is 30 minutes', () => LOCKOUT_DURATION === 30 * 60 * 1000);
|
|
|
|
// Test JWT structure
|
|
console.log('\nTesting JWT token claims:');
|
|
const jwt = require('jsonwebtoken');
|
|
const testToken = jwt.sign({
|
|
id: 1,
|
|
username: 'testuser',
|
|
type: 'admin',
|
|
ip: '127.0.0.1',
|
|
loginTime: Date.now()
|
|
}, 'test-secret', {
|
|
expiresIn: '24h',
|
|
issuer: 'picpeak-auth'
|
|
});
|
|
|
|
const decoded = jwt.verify(testToken, 'test-secret', { complete: true });
|
|
test('Token has issuer claim', () => decoded.payload.iss === 'picpeak-auth');
|
|
test('Token has IP claim', () => decoded.payload.ip === '127.0.0.1');
|
|
test('Token has loginTime claim', () => typeof decoded.payload.loginTime === 'number');
|
|
test('Token expires in 24 hours', () => {
|
|
const exp = decoded.payload.exp;
|
|
const iat = decoded.payload.iat;
|
|
return (exp - iat) === 24 * 60 * 60;
|
|
});
|
|
|
|
// Test auth middleware logic
|
|
console.log('\nTesting auth middleware logic:');
|
|
test('Token type validation works', () => {
|
|
const adminToken = { type: 'admin' };
|
|
const galleryToken = { type: 'gallery' };
|
|
const invalidToken = { type: 'invalid' };
|
|
|
|
return adminToken.type === 'admin' &&
|
|
galleryToken.type === 'gallery' &&
|
|
invalidToken.type !== 'admin' &&
|
|
invalidToken.type !== 'gallery';
|
|
});
|
|
|
|
// Test IP validation logic
|
|
console.log('\nTesting IP validation:');
|
|
test('IP mismatch is detected', () => {
|
|
const tokenIp = '192.168.1.100';
|
|
const currentIp = '10.0.0.50';
|
|
return tokenIp !== currentIp;
|
|
});
|
|
|
|
// Test password change detection
|
|
console.log('\nTesting password change detection:');
|
|
test('Token issued before password change is invalid', () => {
|
|
const tokenIssuedAt = Math.floor(Date.now() / 1000) - 3600; // 1 hour ago
|
|
const passwordChangedAt = Math.floor(Date.now() / 1000) - 1800; // 30 minutes ago
|
|
return tokenIssuedAt < passwordChangedAt;
|
|
});
|
|
|
|
// Summary
|
|
console.log('\n=== Test Summary ===');
|
|
console.log(`Total tests: ${passed + failed}`);
|
|
console.log(`Passed: ${passed}`);
|
|
console.log(`Failed: ${failed}`);
|
|
|
|
if (failed === 0) {
|
|
console.log('\n✅ All authentication security tests passed!');
|
|
process.exit(0);
|
|
} else {
|
|
console.log('\n❌ Some tests failed. Review the implementation.');
|
|
process.exit(1);
|
|
} |