fix(security)!: mitigate session token hashing vulnerability

packages/core/src/session/stateful/createSession.ts

@@ -44,14 +44,14 @@ export const createSession = <DefaultUser extends User>({ ctx, cookies, cookieMa
             throw new AuraAuthError({ code: "INVALID_USER_INFO" })
         }
 
-        const secretValue = createSecretValue(64)
+        const sessionToken = createSecretValue(64)
         logger?.log("STATEFUL_TOKEN_GENERATED", {
             structuredData: {
-                token_length: secretValue.length,
+                token_length: sessionToken.length,
             },
         })
 
-        const tokenHash = await createHash(secretValue)
+        const tokenHash = await createHash(sessionToken)
         logger?.log("STATEFUL_TOKEN_HASHED", {
             structuredData: {
                 hash_length: tokenHash.length,
@@ -142,6 +142,6 @@ export const createSession = <DefaultUser extends User>({ ctx, cookies, cookieMa
             },
         })
 
-        return secretValue
+        return sessionToken
     }
 }

packages/core/src/session/stateful/destroySession.ts

@@ -1,5 +1,6 @@
 import { getErrorName, verifyCSRFToken } from "@/shared/utils.ts"
 import type { InternalStatefulContext } from "@/@types/index.ts"
+import { createHash } from "@/shared/crypto.ts"
 
 export const destroySession = ({ ctx, cookies, cookieManager }: InternalStatefulContext) => {
     const { logger, sessionConfig, jose } = ctx
@@ -30,7 +31,8 @@ export const destroySession = ({ ctx, cookies, cookieManager }: InternalStateful
             })
 
             if (sessionToken) {
-                const sessionByToken = await sessionConfig.adapter.getSessionByToken(sessionToken)
+                const tokenHash = await createHash(sessionToken)
+                const sessionByToken = await sessionConfig.adapter.getSessionByToken(tokenHash)
                 logger?.log("STATEFUL_SESSION_DB_LOOKUP", {
                     structuredData: {
                         session_found: Boolean(sessionByToken),

packages/core/src/session/stateful/getProviderTokens.ts

@@ -3,6 +3,7 @@ import { handleApiError } from "@/shared/utils/api.ts"
 import { getErrorName, shouldRefresh } from "@/shared/utils.ts"
 import { refreshProviderToken } from "@/shared/utils/refresh-tokens.ts"
 import type { GetProviderTokensStatefulReturn, InternalStatefulContext } from "@/@types/index.ts"
+import { createHash } from "@/shared/crypto.ts"
 
 export const getProviderTokens = ({ ctx, cookieManager }: InternalStatefulContext) => {
     const { oauth, logger, sessionConfig } = ctx
@@ -37,7 +38,8 @@ export const getProviderTokens = ({ ctx, cookieManager }: InternalStatefulContex
                 return { success: false, error: { code, message }, tokens: null, headers: cookieManager.clear(), statusCode }
             }
 
-            const sessionByToken = await sessionConfig.adapter.getSessionByToken(sessionToken)
+            const tokenHash = await createHash(sessionToken)
+            const sessionByToken = await sessionConfig.adapter.getSessionByToken(tokenHash)
             if (!sessionByToken || !sessionByToken.user) {
                 logger?.log("STATEFUL_GET_PROVIDER_TOKENS_SESSION_INVALID", {
                     structuredData: {

packages/core/src/session/stateful/getSession.ts

@@ -1,4 +1,5 @@
 import { getErrorName } from "@/shared/utils.ts"
+import { createHash } from "@/shared/crypto.ts"
 import { AuraAuthError } from "@/shared/errors.ts"
 import { secureApiHeaders } from "@/shared/headers.ts"
 import type { GetStatefulSessionReturn, User, InternalStatefulContext } from "@/@types/index.ts"
@@ -36,7 +37,8 @@ export const getSession = <DefaultUser extends User>({ ctx, cookieManager }: Int
                 }
             }
 
-            const session = await sessionConfig.adapter.getSessionByToken(sessionToken)
+            const tokenHash = await createHash(sessionToken)
+            const session = await sessionConfig.adapter.getSessionByToken(tokenHash)
             logger?.log("STATEFUL_SESSION_DB_LOOKUP", {
                 structuredData: {
                     session_found: Boolean(session),

packages/core/src/session/stateful/isProviderConnected.ts

@@ -1,5 +1,6 @@
 import { getErrorName } from "@/shared/utils.ts"
 import type { InternalStatefulContext } from "@/@types/index.ts"
+import { createHash } from "@/shared/crypto.ts"
 
 export const isProviderConnected = ({ ctx, cookieManager }: InternalStatefulContext) => {
     const { logger, sessionConfig } = ctx
@@ -23,7 +24,8 @@ export const isProviderConnected = ({ ctx, cookieManager }: InternalStatefulCont
                 return false
             }
 
-            const sessionByToken = await sessionConfig.adapter.getSessionByToken(sessionToken)
+            const tokenHash = await createHash(sessionToken)
+            const sessionByToken = await sessionConfig.adapter.getSessionByToken(tokenHash)
             if (!sessionByToken || !sessionByToken.user) {
                 logger?.log("AUTH_SESSION_INVALID", {
                     structuredData: {

packages/core/src/session/stateful/oauthCallback.ts

@@ -239,7 +239,7 @@ export const oauthCallback = ({ ctx, cookies, cookieManager }: InternalStatefulC
 
         const headersBuilder = new HeadersBuilder()
             .setHeader("Location", transaction.redirectTo || "/")
-            .setCookie(cookies().sessionToken.name, tokenHash, cookies().sessionToken.attributes)
+            .setCookie(cookies().sessionToken.name, sessionToken, cookies().sessionToken.attributes)
             .setCookie(cookies().csrfToken.name, csrfToken, cookies().csrfToken.attributes)
 
         return Response.json({ oauth: oauthId }, { status: 302, headers: headersBuilder.toHeaders() })

packages/core/src/session/stateful/refreshSession.ts

@@ -1,6 +1,7 @@
 import { getErrorName, verifyCSRFToken } from "@/shared/utils.ts"
 import type { DeepPartial } from "@/@types/utility.ts"
 import type { InternalStatefulContext, Session, User } from "@/@types/index.ts"
+import { createHash } from "@/shared/crypto.ts"
 
 export const refreshSession = <DefaultUser extends User>({ ctx, cookies, cookieManager }: InternalStatefulContext) => {
     const { logger, sessionConfig, jose } = ctx
@@ -68,7 +69,8 @@ export const refreshSession = <DefaultUser extends User>({ ctx, cookies, cookieM
                 return { session: null, headers: cookieManager.clear() }
             }
 
-            const sessionByToken = await sessionConfig.adapter.getSessionByToken(sessionToken)
+            const tokenHash = await createHash(sessionToken)
+            const sessionByToken = await sessionConfig.adapter.getSessionByToken(tokenHash)
             logger?.log("STATEFUL_SESSION_DB_LOOKUP", {
                 structuredData: {
                     session_found: Boolean(sessionByToken),

packages/core/src/session/stateful/revokeToken.ts

@@ -5,6 +5,7 @@ import { secureApiHeaders } from "@/shared/headers.ts"
 import { revokeProviderToken } from "@/shared/utils/revoke-token.ts"
 import { getErrorName, toUnionHeaders } from "@/shared/utils.ts"
 import type { InternalStatefulContext } from "@/@types/index.ts"
+import { createHash } from "@/shared/crypto.ts"
 
 export const revokeToken = ({ ctx, cookieManager }: InternalStatefulContext) => {
     const { oauth, logger, sessionConfig, cookies } = ctx
@@ -29,7 +30,8 @@ export const revokeToken = ({ ctx, cookieManager }: InternalStatefulContext) =>
                 throw new AuraAuthError({ code: "SESSION_NOT_FOUND" })
             }
 
-            const sessionByToken = await sessionConfig.adapter.getSessionByToken(sessionToken)
+            const tokenHash = await createHash(sessionToken)
+            const sessionByToken = await sessionConfig.adapter.getSessionByToken(tokenHash)
             if (!sessionByToken || !sessionByToken.user) {
                 logger?.log("AUTH_SESSION_INVALID", {
                     structuredData: {

packages/core/src/session/stateful/signInCredentials.ts

@@ -40,14 +40,14 @@ export const signInCredentials = ({ ctx, cookies, cookieManager }: InternalState
 
         const device = await createDevice(user.id, request)
 
-        const secretValue = createSecretValue(64)
+        const sessionToken = createSecretValue(64)
         logger?.log("STATEFUL_TOKEN_GENERATED", {
             structuredData: {
-                token_length: secretValue.length,
+                token_length: sessionToken.length,
             },
         })
 
-        const tokenHash = await createHash(secretValue)
+        const tokenHash = await createHash(sessionToken)
         logger?.log("STATEFUL_TOKEN_HASHED", {
             structuredData: {
                 hash_length: tokenHash.length,
@@ -91,6 +91,6 @@ export const signInCredentials = ({ ctx, cookies, cookieManager }: InternalState
             },
         })
 
-        return tokenHash
+        return sessionToken
     }
 }

packages/core/src/session/stateful/signUp.ts

@@ -88,14 +88,14 @@ export const signUp = ({ ctx, cookies, cookieManager }: InternalStatefulContext)
         }
 
         const device = await createDevice(user.id, request)
-        const secretValue = createSecretValue(64)
+        const sessionToken = createSecretValue(64)
         logger?.log("STATEFUL_TOKEN_GENERATED", {
             structuredData: {
-                token_length: secretValue.length,
+                token_length: sessionToken.length,
             },
         })
 
-        const tokenHash = await createHash(secretValue)
+        const tokenHash = await createHash(sessionToken)
         logger?.log("STATEFUL_TOKEN_HASHED", {
             structuredData: {
                 hash_length: tokenHash.length,
@@ -139,6 +139,6 @@ export const signUp = ({ ctx, cookies, cookieManager }: InternalStatefulContext)
             },
         })
 
-        return secretValue
+        return sessionToken
     }
 }

packages/core/src/shared/utils/api.ts

@@ -19,6 +19,7 @@ import type {
 } from "@/@types/index.ts"
 import { isStatelessStrategy } from "../assert.ts"
 import { createCookieManager } from "@/session/cookie-manager.ts"
+import { createHash } from "../crypto.ts"
 
 export const createValidation = (ctx: RouterGlobalContext, headersInit?: HeadersInit) => {
     const headers = new Headers(headersInit)
@@ -56,7 +57,11 @@ export const createValidation = (ctx: RouterGlobalContext, headersInit?: Headers
                     })
                 } else {
                     const { sessionToken } = createCookieManager(() => ctx.cookies).getCookie(new Headers(headersInit))
-                    const session = await ctx.sessionConfig.adapter.getSessionByToken(sessionToken)
+                    if (!sessionToken) {
+                        throw new AuraAuthError({ code: "SESSION_NOT_FOUND" })
+                    }
+                    const tokenHash = await createHash(sessionToken)
+                    const session = await ctx.sessionConfig.adapter.getSessionByToken(tokenHash)
                     if (!session) {
                         throw new AuraAuthError({ code: "SESSION_NOT_FOUND" })
                     }

packages/core/test/actions/providers/connected/stateful.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect, vi } from "vitest"
-import { createCSRF } from "@/shared/crypto.ts"
+import { createCSRF, createHash } from "@/shared/crypto.ts"
 import { accountEntity, authInstance, jose, oauthTokens, sessionEntityWithUser, sessionPayload } from "@test/presets.ts"
 
 describe("connectedAction", () => {
@@ -73,6 +73,7 @@ describe("connectedAction", () => {
         })
 
         const csrfToken = await createCSRF(jose)
+        const tokenHash = await createHash("valid-token-hash")
 
         const response = await GET(
             new Request("https://example.com/auth/providers/oauth-provider", {
@@ -88,7 +89,9 @@ describe("connectedAction", () => {
             connected: false,
         })
 
-        expect(getSessionByTokenMock).toHaveBeenCalledWith("valid-token-hash")
+        expect(getSessionByTokenMock).toHaveBeenCalledTimes(2)
+        expect(getSessionByTokenMock).toHaveBeenNthCalledWith(1, tokenHash)
+        expect(getSessionByTokenMock).toHaveBeenNthCalledWith(2, tokenHash)
         expect(getAccountsByUserIdMock).not.toHaveBeenCalled()
     })
 
@@ -107,6 +110,7 @@ describe("connectedAction", () => {
         })
 
         const csrfToken = await createCSRF(jose)
+        const tokenHash = await createHash("valid-token-hash")
 
         const response = await GET(
             new Request("https://example.com/auth/providers/oauth-provider", {
@@ -123,7 +127,7 @@ describe("connectedAction", () => {
             connected: true,
         })
 
-        expect(getSessionByTokenMock).toHaveBeenCalledWith("valid-token-hash")
+        expect(getSessionByTokenMock).toHaveBeenCalledWith(tokenHash)
         expect(getAccountsByUserIdMock).toHaveBeenCalledWith(sessionEntityWithUser.userId)
     })