diff --git a/src/sspoc/server.py b/src/sspoc/server.py index fe5ed92..3a51a5f 100644 --- a/src/sspoc/server.py +++ b/src/sspoc/server.py @@ -177,20 +177,20 @@ def main(): prog='session-security-poc', description='Program to demostrate improved user session security') parser.add_argument('--host', default='127.0.0.1') - parser.add_argument('--port', default='8080') + parser.add_argument('--port', default='1443') parser.add_argument('--key-file') parser.add_argument('--cert-file') - parser.add_argument('--tls-self-signed', action='store_true') + parser.add_argument('--disable-tls', action='store_true') args = parser.parse_args(sys.argv[1:]) - if args.tls_self_signed: - ssl_context = 'adhoc' - elif args.key_file and args.cert_file: + if args.key_file and args.cert_file: ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) ssl_context.load_cert_chain(certfile=args.cert_file, keyfile=args.key_file) + elif args.disable_tls: + ssl_context = None else: - ssl_context = None + ssl_context = 'adhoc' app.run(host=args.host, port=args.port, ssl_context=ssl_context) diff --git a/src/sspoc/static/index.html b/src/sspoc/static/index.html index 1d28940..672e409 100644 --- a/src/sspoc/static/index.html +++ b/src/sspoc/static/index.html @@ -4,12 +4,47 @@ +
+ + + + + + + + + + + + + + + + + + + + + + + + + +
UsernamePassword
user1password
user2password
user3password
user4password
+
- + - +
+
+
+ + + +
+
\ No newline at end of file diff --git a/src/sspoc/static/js/sspoc.js b/src/sspoc/static/js/sspoc.js index 4ac5f00..8509890 100644 --- a/src/sspoc/static/js/sspoc.js +++ b/src/sspoc/static/js/sspoc.js @@ -71,6 +71,7 @@ loginButton.addEventListener('click', async evt => { let paragraph = document.createElement('p'); paragraph.textContent = await response.text(); document.body.appendChild(paragraph); + setTimeout(() => document.body.removeChild(paragraph), 10000); } const nonceHeader = response.headers.get('nonce'); const encryptedNonce = atob(nonceHeader); @@ -82,10 +83,10 @@ loginButton.addEventListener('click', async evt => { }); }); -async function computeToken() { +async function computeToken(instant) { if(nonce != null) { const crypto = window.crypto.subtle; - const epochTick = Math.floor(new Date().getTime() / 3000); + const epochTick = Math.floor(instant / 3000); const data = concatenateUInt8Arrays(nonce, integerToBytes(epochTick, 8)); const hash = new Uint8Array(await crypto.digest("SHA-256", data)); const token = btoa(Array.from(hash, byte => String.fromCharCode(byte)).join('')); @@ -95,15 +96,19 @@ async function computeToken() { } } -let div = document.createElement('div'); -document.body.appendChild(div); -let whoamiButton = document.createElement('button'); -whoamiButton.textContent = 'whoami' -div.appendChild(whoamiButton); +const whoamiButton = document.getElementById('whoami-button'); +const whoamiForm = document.getElementById('whoami-form'); +const timeDriftLabel = whoamiForm.querySelector("label em"); +const timeDriftSlider = whoamiForm['time-drift-slider']; +timeDriftSlider.addEventListener('input', evt => { + timeDriftLabel.textContent = parseInt(evt.target.value) / 1000 + ' s'; +}); whoamiButton.addEventListener('click', async evt => { - const token = await computeToken(); + const drift = parseInt(timeDriftSlider.value); + const instant = new Date().getTime() + drift; + const token = await computeToken(instant); let headers = {}; if (token != null) { headers = { @@ -117,27 +122,27 @@ whoamiButton.addEventListener('click', async evt => { let paragraph = document.createElement('p'); paragraph.textContent = text; document.body.appendChild(paragraph); + setTimeout(() => document.body.removeChild(paragraph), 10000); }); }); -let helloButton = document.createElement('button'); -helloButton.textContent = 'hello' -div.appendChild(helloButton); +// const helloButton = document.createElement('button'); +// helloButton.textContent = 'hello' -helloButton.addEventListener('click', async evt => { - const token = await computeToken(); - let headers = {}; - if (token != null) { - headers = { - 'x-token': token - }; - } - fetch('api/hello', { - method: 'GET', - headers - }).then(response => response.text()).then(text => { - let paragraph = document.createElement('p'); - paragraph.textContent = text; - document.body.appendChild(paragraph); - }); -}); +// helloButton.addEventListener('click', async evt => { +// const token = await computeToken(); +// let headers = {}; +// if (token != null) { +// headers = { +// 'x-token': token +// }; +// } +// fetch('api/hello', { +// method: 'GET', +// headers +// }).then(response => response.text()).then(text => { +// let paragraph = document.createElement('p'); +// paragraph.textContent = text; +// document.body.appendChild(paragraph); +// }); +// });