feat(auth): optional WEBTERM_TOKEN access-token gate (W5)
An OPTIONAL shared token so the app can be used off-LAN (via the relay/tunnel) more safely than "anyone who reaches the port gets a shell". Sits IN FRONT OF the existing Origin/CSRF model — never replacing it — and is fully inert when unset. - src/http/auth.ts (new, pure): constantTimeEqual hashes both inputs to sha256 (32 bytes) then crypto.timingSafeEqual — no `===`, no length side-channel, never throws. parseCookieHeader / cookieIsAuthed / buildSetCookie / isAuthEnabled. - WEBTERM_TOKEN in config: 16–512 URL/cookie-safe chars or the server refuses to start. - GET /?token=<t> or POST /auth (rate-limited 10/min) validates → sets HttpOnly; SameSite=Strict; Secure-when-https cookie; public/login.html (no <script>). - When enabled: the WS handshake (AFTER the Origin check, before handleUpgrade) + a central authGate over all remote HTTP require the cookie. Open: /login, /auth. Loopback bypass scoped to /hook* ONLY (tighter than the plan — gates the local browser too). - Unset ⇒ isAuthEnabled false ⇒ pure passthrough (LAN zero-config unchanged). Honest tradeoff (in code + CLAUDE.md + login page): a bar-raiser, NOT a TLS/Tailscale substitute — on bare ws:// the token is cleartext + replayable; only hardens the TLS-terminated relay path. Verified: typecheck + build:web clean, 2118 pass at --test-timeout=30000 (disabled-mode regression proven; only the known tmux flake red); auth.ts 100% line coverage.
This commit is contained in:
Yaojia Wang
125
public/login.html
Normal file
125
public/login.html
Normal file
@@ -0,0 +1,125 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<meta name="robots" content="noindex" />
|
||||
<title>Sign in — web-terminal</title>
|
||||
<!--
|
||||
w5-access-token login page. FULLY SELF-CONTAINED: inline <style> only, NO
|
||||
<script> (the CSP is `script-src 'self'`, which blocks inline JS). Auth is a
|
||||
native form POST → the server 302s and sets the HttpOnly cookie → the app
|
||||
loads. Zero JS required. The error banner is revealed server-side by GET
|
||||
/login?e=1 swapping the single `ERRSTATE` token on <body> for `show-error`.
|
||||
-->
|
||||
<style>
|
||||
:root {
|
||||
color-scheme: light dark;
|
||||
--bg: #0b0e14;
|
||||
--card: #131722;
|
||||
--fg: #e6e9ef;
|
||||
--muted: #8b93a7;
|
||||
--accent: #4c8bf5;
|
||||
--border: #262c3a;
|
||||
--err-bg: #3a1720;
|
||||
--err-fg: #ff9aa8;
|
||||
--err-border: #6b2230;
|
||||
}
|
||||
@media (prefers-color-scheme: light) {
|
||||
:root {
|
||||
--bg: #f4f6fb;
|
||||
--card: #ffffff;
|
||||
--fg: #1a1f2b;
|
||||
--muted: #5a6274;
|
||||
--accent: #2563eb;
|
||||
--border: #dde2ec;
|
||||
--err-bg: #fdecef;
|
||||
--err-fg: #b42035;
|
||||
--err-border: #f3c2ca;
|
||||
}
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body {
|
||||
margin: 0;
|
||||
min-height: 100vh;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
padding: 1.5rem;
|
||||
background: var(--bg);
|
||||
color: var(--fg);
|
||||
font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
|
||||
}
|
||||
.card {
|
||||
width: 100%;
|
||||
max-width: 22rem;
|
||||
background: var(--card);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 14px;
|
||||
padding: 1.75rem;
|
||||
box-shadow: 0 12px 40px rgba(0, 0, 0, 0.28);
|
||||
}
|
||||
h1 { margin: 0 0 0.25rem; font-size: 1.15rem; }
|
||||
p.sub { margin: 0 0 1.25rem; color: var(--muted); font-size: 0.85rem; }
|
||||
label { display: block; margin-bottom: 0.4rem; font-size: 0.8rem; color: var(--muted); }
|
||||
input[type="password"] {
|
||||
width: 100%;
|
||||
padding: 0.65rem 0.75rem;
|
||||
font-size: 1rem;
|
||||
color: var(--fg);
|
||||
background: var(--bg);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 9px;
|
||||
outline: none;
|
||||
}
|
||||
input[type="password"]:focus { border-color: var(--accent); }
|
||||
button {
|
||||
margin-top: 1rem;
|
||||
width: 100%;
|
||||
padding: 0.7rem;
|
||||
font-size: 0.95rem;
|
||||
font-weight: 600;
|
||||
color: #fff;
|
||||
background: var(--accent);
|
||||
border: 0;
|
||||
border-radius: 9px;
|
||||
cursor: pointer;
|
||||
}
|
||||
button:hover { filter: brightness(1.06); }
|
||||
.error-banner {
|
||||
display: none;
|
||||
margin-bottom: 1rem;
|
||||
padding: 0.6rem 0.75rem;
|
||||
font-size: 0.85rem;
|
||||
color: var(--err-fg);
|
||||
background: var(--err-bg);
|
||||
border: 1px solid var(--err-border);
|
||||
border-radius: 9px;
|
||||
}
|
||||
body.show-error .error-banner { display: block; }
|
||||
.note {
|
||||
margin-top: 1.25rem;
|
||||
font-size: 0.72rem;
|
||||
line-height: 1.45;
|
||||
color: var(--muted);
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body class="login ERRSTATE">
|
||||
<main class="card">
|
||||
<h1>Access token required</h1>
|
||||
<p class="sub">This web-terminal is protected by a shared access token.</p>
|
||||
<div class="error-banner" role="alert">Invalid token — please try again.</div>
|
||||
<form method="POST" action="/auth">
|
||||
<label for="token">Access token</label>
|
||||
<input id="token" name="token" type="password" autocomplete="current-password" autofocus required />
|
||||
<button type="submit">Unlock</button>
|
||||
</form>
|
||||
<p class="note">
|
||||
Bar-raiser, not a substitute for TLS/Tailscale. On a plain <code>ws://</code> LAN
|
||||
the token is sent in cleartext and can be replayed — only use this off-LAN over
|
||||
an HTTPS/WSS relay or tunnel. Never port-forward the raw port to the internet.
|
||||
</p>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user