From d896d07d8ba0b886bc420ab547940f69a3e9aa42 Mon Sep 17 00:00:00 2001 From: walter Date: Wed, 7 Sep 2016 19:16:11 -0700 Subject: [PATCH 1/6] Added configuration for owasp. Synchronize client owap configs with the server configs. Also added a time indicator on failed login attempts to give the user feedback on subsequent failed login attempts. --- config/env/development.js | 7 +++++++ config/env/production.js | 7 +++++++ .../services/password-validator.client.service.js | 13 ++++++++++--- modules/users/server/config/strategies/local.js | 2 +- .../users/users.password.server.controller.js | 7 +++++++ modules/users/server/models/user.server.model.js | 6 ++++++ modules/users/server/routes/auth.server.routes.js | 4 ++++ 7 files changed, 42 insertions(+), 4 deletions(-) diff --git a/config/env/development.js b/config/env/development.js index 74526e53..c60bc87c 100644 --- a/config/env/development.js +++ b/config/env/development.js @@ -58,6 +58,13 @@ module.exports = { callbackURL: '/api/auth/paypal/callback', sandbox: true }, + owasp: { + allowPassphrases: true, + maxLength: 128, + minLength: 4, + minPhraseLength: 20, + minOptionalTestsToPass: 2 + }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', options: { diff --git a/config/env/production.js b/config/env/production.js index 3ad416ed..41ebd6ca 100644 --- a/config/env/production.js +++ b/config/env/production.js @@ -78,6 +78,13 @@ module.exports = { callbackURL: '/api/auth/paypal/callback', sandbox: false }, + owasp: { + allowPassphrases : true, + maxLength : 128, + minLength : 10, + minPhraseLength : 20, + minOptionalTestsToPass : 4, + }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', options: { diff --git a/modules/users/client/services/password-validator.client.service.js b/modules/users/client/services/password-validator.client.service.js index d1635586..45697cd5 100644 --- a/modules/users/client/services/password-validator.client.service.js +++ b/modules/users/client/services/password-validator.client.service.js @@ -6,11 +6,18 @@ .module('users.services') .factory('PasswordValidator', PasswordValidator); - PasswordValidator.$inject = ['$window']; + PasswordValidator.$inject = ['$window', '$http']; - function PasswordValidator($window) { + function PasswordValidator($window, $http) { var owaspPasswordStrengthTest = $window.owaspPasswordStrengthTest; + // get the owasp config from the server configuration + $http.get('/password/rules').success(function (response) { + owaspPasswordStrengthTest.configs = response; // same owasp config used on the server + }).error(function (response) { + // well, it should fall back on the default owasp config defined in that package + }); + var service = { getResult: getResult, getPopoverMsg: getPopoverMsg @@ -24,7 +31,7 @@ } function getPopoverMsg() { - var popoverMsg = 'Please enter a passphrase or password with 10 or more characters, numbers, lowercase, uppercase, and special characters.'; + var popoverMsg = 'Please enter a passphrase or password with ' + owaspPasswordStrengthTest.configs.minLength + ' or more characters, numbers, lowercase, uppercase, and special characters.'; return popoverMsg; } diff --git a/modules/users/server/config/strategies/local.js b/modules/users/server/config/strategies/local.js index 9caa9091..a458e8d7 100644 --- a/modules/users/server/config/strategies/local.js +++ b/modules/users/server/config/strategies/local.js @@ -22,7 +22,7 @@ module.exports = function () { } if (!user || !user.authenticate(password)) { return done(null, false, { - message: 'Invalid username or password' + message: 'Invalid username or password (' + (new Date()).toLocaleTimeString() + ')' }); } diff --git a/modules/users/server/controllers/users/users.password.server.controller.js b/modules/users/server/controllers/users/users.password.server.controller.js index 06197fba..1c96d274 100644 --- a/modules/users/server/controllers/users/users.password.server.controller.js +++ b/modules/users/server/controllers/users/users.password.server.controller.js @@ -14,6 +14,13 @@ var path = require('path'), var smtpTransport = nodemailer.createTransport(config.mailer.options); +/** + * Get the server defined owasp config for the client + */ +exports.getowaspconfig = function (req, res) { + res.json(config.owasp); +}; + /** * Forgot for reset password (forgot POST) */ diff --git a/modules/users/server/models/user.server.model.js b/modules/users/server/models/user.server.model.js index 0797faa4..f734244c 100644 --- a/modules/users/server/models/user.server.model.js +++ b/modules/users/server/models/user.server.model.js @@ -4,12 +4,18 @@ * Module dependencies */ var mongoose = require('mongoose'), + path = require('path'), + config = require(path.resolve('./config/config')), Schema = mongoose.Schema, crypto = require('crypto'), validator = require('validator'), generatePassword = require('generate-password'), owasp = require('owasp-password-strength-test'); + +owasp.configs = config.owasp; + + /** * A Validation function for local strategy properties */ diff --git a/modules/users/server/routes/auth.server.routes.js b/modules/users/server/routes/auth.server.routes.js index eb73b5ea..4795a080 100644 --- a/modules/users/server/routes/auth.server.routes.js +++ b/modules/users/server/routes/auth.server.routes.js @@ -54,4 +54,8 @@ module.exports = function (app) { // Setting the paypal oauth routes app.route('/api/auth/paypal').get(users.oauthCall('paypal')); app.route('/api/auth/paypal/callback').get(users.oauthCallback('paypal')); + + + // get the config settings for the client side owasp + app.route('/password/rules').get(users.getowaspconfig); }; From 4ddb0593461c92f80f9f01c8360a19c1bdb6b8cf Mon Sep 17 00:00:00 2001 From: walter Date: Thu, 8 Sep 2016 11:17:41 -0700 Subject: [PATCH 2/6] switched to handlebar template for passing the server's owasp config down to the client. reverted some of the other changes (regarding the http request). --- config/env/production.js | 10 +++++----- config/env/test.js | 7 +++++++ .../core/server/controllers/core.server.controller.js | 8 +++++--- modules/core/server/views/layout.server.view.html | 5 +++++ .../services/password-validator.client.service.js | 10 ++-------- .../users/users.password.server.controller.js | 6 ------ modules/users/server/models/user.server.model.js | 2 +- modules/users/server/routes/auth.server.routes.js | 4 ---- 8 files changed, 25 insertions(+), 27 deletions(-) diff --git a/config/env/production.js b/config/env/production.js index 41ebd6ca..b7fb331c 100644 --- a/config/env/production.js +++ b/config/env/production.js @@ -79,11 +79,11 @@ module.exports = { sandbox: false }, owasp: { - allowPassphrases : true, - maxLength : 128, - minLength : 10, - minPhraseLength : 20, - minOptionalTestsToPass : 4, + allowPassphrases: true, + maxLength: 128, + minLength: 10, + minPhraseLength: 20, + minOptionalTestsToPass: 4 }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', diff --git a/config/env/test.js b/config/env/test.js index f8fb5d73..c3583ff6 100644 --- a/config/env/test.js +++ b/config/env/test.js @@ -59,6 +59,13 @@ module.exports = { callbackURL: '/api/auth/paypal/callback', sandbox: true }, + owasp: { + allowPassphrases: true, + maxLength: 128, + minLength: 10, + minPhraseLength: 20, + minOptionalTestsToPass: 4 + }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', options: { diff --git a/modules/core/server/controllers/core.server.controller.js b/modules/core/server/controllers/core.server.controller.js index ed9b0440..96b6152e 100644 --- a/modules/core/server/controllers/core.server.controller.js +++ b/modules/core/server/controllers/core.server.controller.js @@ -1,12 +1,13 @@ 'use strict'; -var validator = require('validator'); +var validator = require('validator'), + path = require('path'), + config = require(path.resolve('./config/config')); /** * Render the main application page */ exports.renderIndex = function (req, res) { - var safeUserObject = null; if (req.user) { safeUserObject = { @@ -24,7 +25,8 @@ exports.renderIndex = function (req, res) { } res.render('modules/core/server/views/index', { - user: JSON.stringify(safeUserObject) + user: JSON.stringify(safeUserObject), + owaspcfg: JSON.stringify(config.owasp) }); }; diff --git a/modules/core/server/views/layout.server.view.html b/modules/core/server/views/layout.server.view.html index d7327245..74cec8f4 100644 --- a/modules/core/server/views/layout.server.view.html +++ b/modules/core/server/views/layout.server.view.html @@ -65,6 +65,11 @@ {{#each jsFiles}}{{/each}} + + + {{#if livereload}} diff --git a/modules/users/client/services/password-validator.client.service.js b/modules/users/client/services/password-validator.client.service.js index 45697cd5..0128ed82 100644 --- a/modules/users/client/services/password-validator.client.service.js +++ b/modules/users/client/services/password-validator.client.service.js @@ -6,17 +6,11 @@ .module('users.services') .factory('PasswordValidator', PasswordValidator); - PasswordValidator.$inject = ['$window', '$http']; + PasswordValidator.$inject = ['$window']; - function PasswordValidator($window, $http) { + function PasswordValidator($window) { var owaspPasswordStrengthTest = $window.owaspPasswordStrengthTest; - // get the owasp config from the server configuration - $http.get('/password/rules').success(function (response) { - owaspPasswordStrengthTest.configs = response; // same owasp config used on the server - }).error(function (response) { - // well, it should fall back on the default owasp config defined in that package - }); var service = { getResult: getResult, diff --git a/modules/users/server/controllers/users/users.password.server.controller.js b/modules/users/server/controllers/users/users.password.server.controller.js index 1c96d274..136c21d3 100644 --- a/modules/users/server/controllers/users/users.password.server.controller.js +++ b/modules/users/server/controllers/users/users.password.server.controller.js @@ -14,12 +14,6 @@ var path = require('path'), var smtpTransport = nodemailer.createTransport(config.mailer.options); -/** - * Get the server defined owasp config for the client - */ -exports.getowaspconfig = function (req, res) { - res.json(config.owasp); -}; /** * Forgot for reset password (forgot POST) diff --git a/modules/users/server/models/user.server.model.js b/modules/users/server/models/user.server.model.js index f734244c..e4ed23c3 100644 --- a/modules/users/server/models/user.server.model.js +++ b/modules/users/server/models/user.server.model.js @@ -12,7 +12,7 @@ var mongoose = require('mongoose'), generatePassword = require('generate-password'), owasp = require('owasp-password-strength-test'); - +console.log(config.owasp, "========================================================", path.resolve('./config/config')); owasp.configs = config.owasp; diff --git a/modules/users/server/routes/auth.server.routes.js b/modules/users/server/routes/auth.server.routes.js index 4795a080..eb73b5ea 100644 --- a/modules/users/server/routes/auth.server.routes.js +++ b/modules/users/server/routes/auth.server.routes.js @@ -54,8 +54,4 @@ module.exports = function (app) { // Setting the paypal oauth routes app.route('/api/auth/paypal').get(users.oauthCall('paypal')); app.route('/api/auth/paypal/callback').get(users.oauthCallback('paypal')); - - - // get the config settings for the client side owasp - app.route('/password/rules').get(users.getowaspconfig); }; From c0a1ce5ea5a3a8bf5581903abb62bec4767facdd Mon Sep 17 00:00:00 2001 From: walter Date: Thu, 8 Sep 2016 11:25:05 -0700 Subject: [PATCH 3/6] Removed debug code. --- modules/users/server/models/user.server.model.js | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/users/server/models/user.server.model.js b/modules/users/server/models/user.server.model.js index e4ed23c3..a0248e39 100644 --- a/modules/users/server/models/user.server.model.js +++ b/modules/users/server/models/user.server.model.js @@ -12,7 +12,6 @@ var mongoose = require('mongoose'), generatePassword = require('generate-password'), owasp = require('owasp-password-strength-test'); -console.log(config.owasp, "========================================================", path.resolve('./config/config')); owasp.configs = config.owasp; From d73d6baa7c2308d5c73022fe43fe07057abedab0 Mon Sep 17 00:00:00 2001 From: walter Date: Thu, 8 Sep 2016 11:28:30 -0700 Subject: [PATCH 4/6] Changed variable name to owaspConfig --- modules/core/server/controllers/core.server.controller.js | 2 +- modules/core/server/views/layout.server.view.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/core/server/controllers/core.server.controller.js b/modules/core/server/controllers/core.server.controller.js index 96b6152e..d4ca4094 100644 --- a/modules/core/server/controllers/core.server.controller.js +++ b/modules/core/server/controllers/core.server.controller.js @@ -26,7 +26,7 @@ exports.renderIndex = function (req, res) { res.render('modules/core/server/views/index', { user: JSON.stringify(safeUserObject), - owaspcfg: JSON.stringify(config.owasp) + owaspConfig: JSON.stringify(config.owasp) }); }; diff --git a/modules/core/server/views/layout.server.view.html b/modules/core/server/views/layout.server.view.html index 74cec8f4..bbc94cc9 100644 --- a/modules/core/server/views/layout.server.view.html +++ b/modules/core/server/views/layout.server.view.html @@ -68,7 +68,7 @@ {{#if livereload}} From 8dcf3f67282588e065c4ac7c48ae4b72bd44f3b0 Mon Sep 17 00:00:00 2001 From: walter Date: Thu, 8 Sep 2016 12:08:37 -0700 Subject: [PATCH 5/6] Fixed minor type-o's and set owasp.config() rather than the underlying configs. --- modules/core/server/views/layout.server.view.html | 2 +- .../users/client/services/password-validator.client.service.js | 1 - .../controllers/users/users.password.server.controller.js | 1 - modules/users/server/models/user.server.model.js | 2 +- 4 files changed, 2 insertions(+), 4 deletions(-) diff --git a/modules/core/server/views/layout.server.view.html b/modules/core/server/views/layout.server.view.html index bbc94cc9..75c99560 100644 --- a/modules/core/server/views/layout.server.view.html +++ b/modules/core/server/views/layout.server.view.html @@ -68,7 +68,7 @@ {{#if livereload}} diff --git a/modules/users/client/services/password-validator.client.service.js b/modules/users/client/services/password-validator.client.service.js index 0128ed82..3c330bcc 100644 --- a/modules/users/client/services/password-validator.client.service.js +++ b/modules/users/client/services/password-validator.client.service.js @@ -11,7 +11,6 @@ function PasswordValidator($window) { var owaspPasswordStrengthTest = $window.owaspPasswordStrengthTest; - var service = { getResult: getResult, getPopoverMsg: getPopoverMsg diff --git a/modules/users/server/controllers/users/users.password.server.controller.js b/modules/users/server/controllers/users/users.password.server.controller.js index 136c21d3..06197fba 100644 --- a/modules/users/server/controllers/users/users.password.server.controller.js +++ b/modules/users/server/controllers/users/users.password.server.controller.js @@ -14,7 +14,6 @@ var path = require('path'), var smtpTransport = nodemailer.createTransport(config.mailer.options); - /** * Forgot for reset password (forgot POST) */ diff --git a/modules/users/server/models/user.server.model.js b/modules/users/server/models/user.server.model.js index a0248e39..ec339990 100644 --- a/modules/users/server/models/user.server.model.js +++ b/modules/users/server/models/user.server.model.js @@ -12,7 +12,7 @@ var mongoose = require('mongoose'), generatePassword = require('generate-password'), owasp = require('owasp-password-strength-test'); -owasp.configs = config.owasp; +owasp.config(config.owasp); /** From 0588eaba48374b766e73b0f6c7081a7d24e3d2e8 Mon Sep 17 00:00:00 2001 From: walter Date: Mon, 12 Sep 2016 11:53:22 -0700 Subject: [PATCH 6/6] Moved owasp config into default and reverted other config files. Modified config to be "shared". This will allow future configurations to be easily passed to the client. --- config/env/default.js | 10 ++++++++++ config/env/development.js | 7 ------- config/env/production.js | 7 ------- config/env/test.js | 7 ------- .../core/server/controllers/core.server.controller.js | 2 +- modules/core/server/views/layout.server.view.html | 3 ++- modules/users/server/models/user.server.model.js | 2 +- 7 files changed, 14 insertions(+), 24 deletions(-) diff --git a/config/env/default.js b/config/env/default.js index a3e8c5e8..9aeb343e 100644 --- a/config/env/default.js +++ b/config/env/default.js @@ -46,5 +46,15 @@ module.exports = { fileSize: 1 * 1024 * 1024 // Max file size in bytes (1 MB) } } + }, + shared: { + owasp: { + allowPassphrases: true, + maxLength: 128, + minLength: 10, + minPhraseLength: 20, + minOptionalTestsToPass: 4 + } } + }; diff --git a/config/env/development.js b/config/env/development.js index c60bc87c..74526e53 100644 --- a/config/env/development.js +++ b/config/env/development.js @@ -58,13 +58,6 @@ module.exports = { callbackURL: '/api/auth/paypal/callback', sandbox: true }, - owasp: { - allowPassphrases: true, - maxLength: 128, - minLength: 4, - minPhraseLength: 20, - minOptionalTestsToPass: 2 - }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', options: { diff --git a/config/env/production.js b/config/env/production.js index b7fb331c..3ad416ed 100644 --- a/config/env/production.js +++ b/config/env/production.js @@ -78,13 +78,6 @@ module.exports = { callbackURL: '/api/auth/paypal/callback', sandbox: false }, - owasp: { - allowPassphrases: true, - maxLength: 128, - minLength: 10, - minPhraseLength: 20, - minOptionalTestsToPass: 4 - }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', options: { diff --git a/config/env/test.js b/config/env/test.js index c3583ff6..f8fb5d73 100644 --- a/config/env/test.js +++ b/config/env/test.js @@ -59,13 +59,6 @@ module.exports = { callbackURL: '/api/auth/paypal/callback', sandbox: true }, - owasp: { - allowPassphrases: true, - maxLength: 128, - minLength: 10, - minPhraseLength: 20, - minOptionalTestsToPass: 4 - }, mailer: { from: process.env.MAILER_FROM || 'MAILER_FROM', options: { diff --git a/modules/core/server/controllers/core.server.controller.js b/modules/core/server/controllers/core.server.controller.js index d4ca4094..c4a8973c 100644 --- a/modules/core/server/controllers/core.server.controller.js +++ b/modules/core/server/controllers/core.server.controller.js @@ -26,7 +26,7 @@ exports.renderIndex = function (req, res) { res.render('modules/core/server/views/index', { user: JSON.stringify(safeUserObject), - owaspConfig: JSON.stringify(config.owasp) + sharedConfig: JSON.stringify(config.shared) }); }; diff --git a/modules/core/server/views/layout.server.view.html b/modules/core/server/views/layout.server.view.html index 75c99560..13c822f4 100644 --- a/modules/core/server/views/layout.server.view.html +++ b/modules/core/server/views/layout.server.view.html @@ -68,7 +68,8 @@ {{#if livereload}} diff --git a/modules/users/server/models/user.server.model.js b/modules/users/server/models/user.server.model.js index ec339990..16c3546e 100644 --- a/modules/users/server/models/user.server.model.js +++ b/modules/users/server/models/user.server.model.js @@ -12,7 +12,7 @@ var mongoose = require('mongoose'), generatePassword = require('generate-password'), owasp = require('owasp-password-strength-test'); -owasp.config(config.owasp); +owasp.config(config.shared.owasp); /**