fix(security): harden auth endpoints against NoSQL injection and add JWT warning

config/index.js

@@ -135,6 +135,7 @@ const initGlobalConfig = async () => {
   configHelper.initSecureMode(config);
   // Print a warning if config.domain is not set
   if (process.env.NODE_ENV !== 'test') configHelper.validateDomainIsSet(config);
+  if (process.env.NODE_ENV !== 'test') configHelper.validateJwtSecret(config);
   // Expose configuration utilities
   const conf = { ...config };
   conf.utils = {

lib/helpers/config.js

@@ -54,6 +54,17 @@ const validateDomainIsSet = (config) => {
   }
 };
 
+/**
+ * @desc Warn if JWT secret is still set to the default placeholder value.
+ * @param {object} config - application configuration object
+ * @returns {void}
+ */
+const validateJwtSecret = (config) => {
+  if (config.jwt && config.jwt.secret === 'WaosSecretKeyExampleToChnageAbsolutely') {
+    console.log(chalk.red('+ Important warning: JWT secret is set to the default value. It should be changed in production via DEVKIT_NODE_jwt_secret.'));
+  }
+};
+
 /**
  * Validate secure parameters and create SSL credentials.
  * @param {object} config - application configuration object
@@ -106,6 +117,7 @@ const initGlobalConfigFiles = async (assets) => {
 export default {
   getGlobbedPaths,
   validateDomainIsSet,
+  validateJwtSecret,
   initSecureMode,
   initGlobalConfigFiles,
 };

modules/auth/controllers/auth.controller.js

@@ -322,6 +322,10 @@ const oauthCallback = async (req, res, next) => {
   const strategy = req.params.strategy;
   // app Auth with Strategy managed on client side
   if (req.body.strategy === false && req.body.key) {
+    const allowedKeys = ['id', 'sub', 'email'];
+    if (!allowedKeys.includes(req.body.key)) {
+      return responses.error(res, 422, 'Unprocessable Entity', 'Invalid provider key')();
+    }
     try {
       let user = {
         firstName: req.body.firstName,

modules/auth/controllers/auth.password.controller.js

@@ -27,9 +27,10 @@ const forgot = async (req, res) => {
   let user;
   // check input
   if (!req.body.email) return responses.error(res, 422, 'Unprocessable Entity', 'Mail field must not be blank')();
+  const email = String(req.body.email);
   // get user generate and add token
   try {
-    user = await UserService.getBrut({ email: req.body.email });
+    user = await UserService.getBrut({ email });
     if (!user) return responses.error(res, 400, 'Bad Request', 'No account with that email has been found')();
     if (user.provider !== 'local')
       return responses.error(res, 400, 'Bad Request', `It seems like you signed up using your ${user.provider} account`)();
@@ -68,7 +69,7 @@ const forgot = async (req, res) => {
  */
 const validateResetToken = async (req, res) => {
   try {
-    const user = await UserService.getBrut({ resetPasswordToken: req.params.token });
+    const user = await UserService.getBrut({ resetPasswordToken: String(req.params.token) });
     if (!user || !user.email) return res.redirect('/api/password/reset/invalid');
     res.redirect(`/api/password/reset/${req.params.token}`);
   } catch (_err) {
@@ -86,9 +87,10 @@ const reset = async (req, res) => {
   let user;
   // check input
   if (!req.body.token || !req.body.newPassword) return responses.error(res, 400, 'Bad Request', 'Password or Token fields must not be blank')();
+  const token = String(req.body.token);
   // get user by token, update with new password, login again
   try {
-    user = await UserService.getBrut({ resetPasswordToken: req.body.token });
+    user = await UserService.getBrut({ resetPasswordToken: token });
     if (!user || !user.email) return responses.error(res, 400, 'Bad Request', 'Password reset token is invalid or has expired.')();
     const edit = {
       password: await AuthService.hashPassword(req.body.newPassword),