sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(auth): token-based handoff for cross-subdomain SSO

Browse Source 
Domain=.sami cookies are silently rejected by real browsers - .sami is an
unregistered custom TLD, so browsers treat sami itself as the effective
public suffix and refuse to set a cookie scoped to it (the same rule that
stops a site from setting a supercookie for all of .com). Confirmed via
curl verbose (cookie dropped, domain must not set cookies for sami) and
via the Firefox console on the actual device (Cookie rejected for invalid
domain) for the same cookie. The session cookie set on status.sami after
TOTP verify could never reach plex.sami/jellyfin.sami/emby.sami/chat.sami
no matter how the cookie itself was built - prior fixes tonight left this
mechanism untouched, which is why the loop persisted.

Fix: /totp/verify mints a short-lived (60s) single-use opaque token. The
status.sami frontend appends it to the redirect URL when bouncing the
user back to a gated service. That services login page exchanges the
token via the new public GET /api/v1/auth/sso-exchange for a host-only
session cookie (no Domain attribute - always accepted). isSessionValid
only checks the cookies HMAC signature, never its Domain, so the host-only
cookie validates identically to the cross-domain one on every existing
check with zero changes to that logic.
This commit is contained in:
Krystie
2026-07-24 05:15:03 -07:00
parent f42e761e52
commit 10f2bf707b
7 changed files with 170 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/routes/auth/sso-gate.js
+41 -1
View File
@@ -1,6 +1,7 @@
const express = require('express');
const { SESSION_TTL, APP, PLEX, TIMEOUTS, buildMediaAuth } = require('../../src/utilities/constants');
const { AuthenticationError, NotFoundError } = require('../../src/utilities/errors');
const { ok } = require('../../src/utils/responses');
/**
* Auth SSO gate routes factory
@@ -202,6 +203,25 @@ module.exports = function(deps) {
}
}, 'auth-app-token'));
// Cross-subdomain SSO handoff: exchanges a short-lived single-use token
// (minted by /totp/verify) for a HOST-ONLY session cookie on whichever
// *.sami origin calls this. Needed because Domain=.sami cookies are
// silently rejected by real browsers (.sami is an unregistered TLD, so
// browsers treat "sami" as the effective public suffix and refuse to set
// a cookie scoped to it) — see middleware.js for the full explanation.
// Public route (no session required to call it) since a fresh visitor to
// a gated service has no session yet by definition; the token itself is
// the credential, and it's one-time-use with a 60s TTL.
router.get('/auth/sso-exchange', (req, res) => {
res.setHeader('Cache-Control', 'no-store');
const token = req.query.token;
if (!session.redeemHandoffToken(token)) {
return errorResponse(res, 401, 'Invalid or expired handoff token');
}
session.setCookieHostOnly(res, totpConfig.sessionDuration);
ok(res, { authenticated: true });
});
// Serve service-specific auto-login page (auth enforced by Caddy forward_auth upstream)
router.get('/auth/login-page', (req, res) => {
const service = (req.query.service || '').replace(/[^a-z]/g, '');
@@ -249,10 +269,30 @@ function buildLoginPage(service) {
// Belt-and-suspenders hard timeout: if nothing in this script succeeds
// within 15s, force-redirect to status.sami so the user can re-auth.
var overallTimer=setTimeout(function(){go('https://status.sami?auth=required&return='+encodeURIComponent(location.href))},15000);
// Cross-subdomain SSO handoff: status.sami can't share its session cookie
// with this origin (Domain=.sami cookies are silently rejected by real
// browsers - .sami isn't a registered TLD, so browsers treat "sami" as the
// effective public suffix). Instead status.sami hands us a one-time token
// in the URL after a successful TOTP verify; exchange it here for a cookie
// scoped to just this host, then strip it from the URL so it can't be
// reused or leak via history/referrer. If there's no token (or the
// exchange fails - expired, already used, etc.) this is a no-op and we
// fall through to the normal check-session flow below exactly as before.
var dcParams=new URLSearchParams(location.search);
var dcToken=dcParams.get('dc_token');
var preExchange=Promise.resolve();
if(dcToken){
dcParams.delete('dc_token');
var dcQs=dcParams.toString();
try{history.replaceState({},'',location.pathname+(dcQs?'?'+dcQs:''))}catch(_){}
preExchange=fetch('/dashcaddy-api/api/auth/sso-exchange?token='+encodeURIComponent(dcToken),{credentials:'include',signal:withTimeout(5000)}).catch(function(){});
}
// Pre-check session before attempting auto-login. If the user is not logged
// in, redirect to status.sami for TOTP auth first. The return= param sends
// them back to this login page after authenticating so auto-login can run.
fetch('/dashcaddy-api/api/auth/totp/check-session',{credentials:'include',cache:'no-store',signal:withTimeout(5000)}).then(function(r){return r.json()}).then(function(st){
preExchange.then(function(){
return fetch('/dashcaddy-api/api/auth/totp/check-session',{credentials:'include',cache:'no-store',signal:withTimeout(5000)})
}).then(function(r){return r.json()}).then(function(st){
if(!st||!st.success||!st.authenticated){go('https://status.sami?auth=required&return='+encodeURIComponent(location.href));return}
${body}
}).catch(function(e){fail('Could not reach DashCaddy. <a href="https://status.sami?auth=required&return='+encodeURIComponent(location.href)+'">Sign in at DashCaddy</a>','Auth check error: '+(e&&e.message||'unknown'))})