admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): enforce session idle and absolute timeouts (#1387)

Browse Source 
* feat(auth): enforce session idle and absolute timeouts

Hosted browser sessions now carry an HMAC-signed, HttpOnly cookie holding
session start, last activity and sign-in method, bound to the Supabase
session. Middleware enforces a 30 min idle and 12 h absolute limit
(reason-coded redirects to /login), a heartbeat route advances idle
activity from real user input, and a client controller warns 2 minutes
before expiry. BankID users are routed back to BankID on re-auth via a
short-lived method hint. API-key and MCP bearer surfaces are exempt;
self-hosted installs default off and can opt in via env vars.

Fixes #362

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): derive session-timeout signing key via HKDF

The HMAC key is now HKDF-derived with a purpose-bound info string, so
the SUPABASE_SERVICE_ROLE_KEY fallback never uses the privileged
credential directly as a signing key. Addresses the security review
finding on PR #1387.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): back signature bytes with a plain ArrayBuffer

crypto.subtle.verify requires a BufferSource; Uint8Array.from is typed
over ArrayBufferLike, which the Vercel TypeScript build rejects. Decode
base64url into a Uint8Array constructed over a fresh ArrayBuffer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): address session-timeout review findings

- signSessionTimeoutState returns null on signing failure instead of
  throwing, so a missing secret degrades the timeout feature in line
  with verifySessionTimeoutState rather than crashing authenticated
  requests; middleware and heartbeat skip the cookie write when null
- heartbeat initializes a fresh signed state for a missing or
  session-mismatched cookie, mirroring middleware, instead of
  returning SESSION_EXPIRED during normal initialization
- sessionStateMatchesUser treats an unresolved current session id as
  a mismatch for session-bound state so another session's cookie is
  never accepted on the userId fallback alone
- drop aria-live from the countdown DialogDescription so screen
  readers are not interrupted every second

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
2026-08-04 09:59:42 +02:00
committed by GitHub
co-authored by Claude Fable 5
parent f55bfc478b
commit 1c9d378df8
21 changed files with 1610 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/supabase/__tests__/middleware.test.ts
+155 -3
View File
@@ -11,6 +11,7 @@ import { NextRequest } from 'next/server'
const state = vi.hoisted(() => ({
user: null as null | { id: string; app_metadata?: Record<string, unknown> },
sessionId: 'session-1' as string | null,
authError: null as unknown,
aal: null as null | { currentLevel: string; nextLevel: string },
factors: null as null | { totp: Array<{ id: string; status: string }> },
@@ -25,6 +26,7 @@ const state = vi.hoisted(() => ({
}>
error: unknown
},
signOut: vi.fn(async () => ({ error: null })),
}))
vi.mock('@supabase/ssr', () => ({
@@ -34,7 +36,10 @@ vi.mock('@supabase/ssr', () => ({
data: { user: state.user },
error: state.authError,
})),
signOut: vi.fn(async () => ({ error: null })),
getClaims: vi.fn(async () => ({
data: { claims: state.sessionId ? { session_id: state.sessionId } : {} },
})),
signOut: state.signOut,
mfa: {
getAuthenticatorAssuranceLevel: vi.fn(async () => ({ data: state.aal })),
listFactors: vi.fn(async () => ({ data: state.factors })),
@@ -58,6 +63,12 @@ vi.mock('@supabase/ssr', () => ({
}))
import { updateSession } from '../middleware'
import {
createSessionTimeoutState,
signSessionTimeoutState,
verifySessionTimeoutState,
} from '@/lib/auth/session-timeout'
import { SESSION_TIMEOUT_COOKIE } from '@/lib/auth/session-timeout-shared'
const ORIGIN = 'http://localhost:3000'
const SIGNED_IN = { id: 'user-1', app_metadata: {} }
@@ -66,19 +77,24 @@ function locationOf(response: Response) {
return response.headers.get('location')
}
function run(path: string) {
return updateSession(new NextRequest(`${ORIGIN}${path}`))
function run(path: string, init?: RequestInit) {
return updateSession(new NextRequest(`${ORIGIN}${path}`, init))
}
describe('updateSession redirect destinations', () => {
const envBackup = {
require: process.env.NEXT_PUBLIC_REQUIRE_MFA,
selfHosted: process.env.NEXT_PUBLIC_SELF_HOSTED,
signingSecret: process.env.SESSION_TIMEOUT_SECRET,
idleTimeout: process.env.NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS,
absoluteTimeout: process.env.NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS,
warning: process.env.NEXT_PUBLIC_SESSION_WARNING_MS,
}
beforeEach(() => {
vi.clearAllMocks()
state.user = null
state.sessionId = 'session-1'
state.authError = null
state.aal = null
state.factors = null
@@ -88,6 +104,10 @@ describe('updateSession redirect destinations', () => {
}
delete process.env.NEXT_PUBLIC_REQUIRE_MFA
delete process.env.NEXT_PUBLIC_SELF_HOSTED
process.env.SESSION_TIMEOUT_SECRET = 'middleware-test-secret'
delete process.env.NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS
delete process.env.NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS
delete process.env.NEXT_PUBLIC_SESSION_WARNING_MS
})
afterEach(() => {
@@ -95,6 +115,138 @@ describe('updateSession redirect destinations', () => {
else process.env.NEXT_PUBLIC_REQUIRE_MFA = envBackup.require
if (envBackup.selfHosted === undefined) delete process.env.NEXT_PUBLIC_SELF_HOSTED
else process.env.NEXT_PUBLIC_SELF_HOSTED = envBackup.selfHosted
if (envBackup.signingSecret === undefined) delete process.env.SESSION_TIMEOUT_SECRET
else process.env.SESSION_TIMEOUT_SECRET = envBackup.signingSecret
if (envBackup.idleTimeout === undefined) delete process.env.NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS
else process.env.NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS = envBackup.idleTimeout
if (envBackup.absoluteTimeout === undefined) delete process.env.NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS
else process.env.NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS = envBackup.absoluteTimeout
if (envBackup.warning === undefined) delete process.env.NEXT_PUBLIC_SESSION_WARNING_MS
else process.env.NEXT_PUBLIC_SESSION_WARNING_MS = envBackup.warning
})
describe('session timeout enforcement', () => {
beforeEach(() => {
state.user = SIGNED_IN
process.env.NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS = '30000'
process.env.NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS = '60000'
process.env.NEXT_PUBLIC_SESSION_WARNING_MS = '10000'
})
async function signedCookie(args?: {
startedAt?: number
lastActivityAt?: number
method?: 'password' | 'bankid'
userId?: string
sessionId?: string | null
}) {
const stateValue = {
...createSessionTimeoutState({
userId: args?.userId ?? 'user-1',
sessionId: args?.sessionId === undefined ? 'session-1' : args.sessionId,
method: args?.method ?? 'password',
now: args?.startedAt ?? Date.now(),
}),
...(args?.lastActivityAt === undefined
? {}
: { lastActivityAt: args.lastActivityAt }),
}
const signed = await signSessionTimeoutState(stateValue)
if (!signed) throw new Error('test signing secret missing')
return signed
}
it('initializes a signed, session-bound cookie for an existing session', async () => {
const response = await run('/settings/tax', {
headers: { cookie: 'gnubok-auth-method=bankid' },
})
expect(response.status).toBe(200)
const encoded = response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
expect(encoded).toBeTruthy()
await expect(verifySessionTimeoutState(encoded)).resolves.toMatchObject({
userId: 'user-1',
sessionId: 'session-1',
method: 'bankid',
})
expect(response.cookies.get('gnubok-auth-method')?.value).toBe('')
})
it('rejects a tampered cookie and revokes only the current session', async () => {
const response = await run('/settings/tax', {
headers: { cookie: `${SESSION_TIMEOUT_COOKIE}=tampered.value` },
})
expect(response.status).toBe(307)
expect(new URL(locationOf(response)!).searchParams.get('reason')).toBe('absolute')
expect(state.signOut).toHaveBeenCalledWith({ scope: 'local' })
expect(response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value).toBe('')
})
it('redirects an idle session with its original method and deep link', async () => {
const now = Date.now()
const encoded = await signedCookie({
startedAt: now - 40_000,
lastActivityAt: now - 30_000,
method: 'bankid',
})
const response = await run('/reports/vat?period=2026-01', {
headers: { cookie: `${SESSION_TIMEOUT_COOKIE}=${encoded}` },
})
const url = new URL(locationOf(response)!)
expect(url.pathname).toBe('/login')
expect(url.searchParams.get('reason')).toBe('idle')
expect(url.searchParams.get('method')).toBe('bankid')
expect(url.searchParams.get('next')).toBe('/reports/vat?period=2026-01')
expect(state.signOut).toHaveBeenCalledWith({ scope: 'local' })
})
it('gives absolute expiry precedence and returns structured API errors', async () => {
const now = Date.now()
const encoded = await signedCookie({
startedAt: now - 60_000,
lastActivityAt: now - 30_000,
})
const response = await run('/api/invoices', {
headers: { cookie: `${SESSION_TIMEOUT_COOKIE}=${encoded}` },
})
expect(response.status).toBe(401)
expect(response.headers.get('x-session-timeout-reason')).toBe('absolute')
await expect(response.json()).resolves.toMatchObject({
error: { code: 'SESSION_EXPIRED', reason: 'absolute' },
})
})
it('does not let a forged Authorization header bypass normal APIs', async () => {
const now = Date.now()
const encoded = await signedCookie({ lastActivityAt: now - 30_000, startedAt: now - 40_000 })
const headers = {
authorization: 'Bearer forged',
cookie: `${SESSION_TIMEOUT_COOKIE}=${encoded}`,
}
expect((await run('/api/invoices', { headers })).status).toBe(401)
expect((await run('/api/v1/companies/c1/invoices', { headers })).status).toBe(200)
})
it('starts a new timeout window when the Supabase session changes', async () => {
const encoded = await signedCookie({ sessionId: 'old-session' })
const response = await run('/settings/tax', {
headers: { cookie: `${SESSION_TIMEOUT_COOKIE}=${encoded}` },
})
expect(response.status).toBe(200)
const renewed = response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
await expect(verifySessionTimeoutState(renewed)).resolves.toMatchObject({
sessionId: 'session-1',
})
expect(state.signOut).not.toHaveBeenCalled()
})
})
// ── Site 1: protected-route bounce ────────────────────────────────────
lib/supabase/middleware.ts
+191 -1
View File
@@ -5,6 +5,24 @@ import { apiPathSkipsMfaGate } from '@/lib/auth/api-mfa-gate'
import { DEFAULT_LOCALE, LOCALE_COOKIE, isLocale } from '@/i18n/config'
import { userHasPassword } from '@/lib/auth/has-password'
import { safeReturnTo } from '@/lib/auth/safe-return-to'
import {
apiRequestSkipsSessionTimeout,
createSessionTimeoutState,
evaluateSessionTimeout,
getSessionTimeoutConfig,
sessionStateMatchesUser,
sessionTimeoutClearCookieOptions,
sessionTimeoutCookieOptions,
signSessionTimeoutState,
verifySessionTimeoutState,
} from '@/lib/auth/session-timeout'
import {
isSessionAuthMethod,
SESSION_AUTH_METHOD_HINT_COOKIE,
SESSION_TIMEOUT_COOKIE,
type SessionAuthMethod,
type SessionTimeoutReason,
} from '@/lib/auth/session-timeout-shared'
export async function updateSession(request: NextRequest) {
let supabaseResponse = NextResponse.next({
@@ -62,6 +80,72 @@ export async function updateSession(request: NextRequest) {
}
}
const timeoutConfig = getSessionTimeoutConfig()
const hasAuthorizationHeader = request.headers.get('authorization') !== null
if (!user) {
clearSessionTimeoutCookies(request, supabaseResponse)
} else if (
timeoutConfig.enabled &&
!apiRequestSkipsSessionTimeout(pathname, hasAuthorizationHeader)
) {
const encodedState = request.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
const sessionId = await getSupabaseSessionId(supabase)
const verifiedState = await verifySessionTimeoutState(encodedState)
if (encodedState && !verifiedState) {
await signOutTimedOutSession(supabase)
return sessionTimeoutResponse(
request,
supabaseResponse,
'absolute',
'password',
)
}
if (
!verifiedState ||
!sessionStateMatchesUser(verifiedState, user.id, sessionId)
) {
const hintedMethod = request.cookies.get(
SESSION_AUTH_METHOD_HINT_COOKIE,
)?.value
const method = isSessionAuthMethod(hintedMethod)
? hintedMethod
: 'password'
const state = createSessionTimeoutState({
userId: user.id,
sessionId,
method,
})
const signedState = await signSessionTimeoutState(state)
if (signedState) {
request.cookies.set(SESSION_TIMEOUT_COOKIE, signedState)
supabaseResponse.cookies.set(
SESSION_TIMEOUT_COOKIE,
signedState,
sessionTimeoutCookieOptions(),
)
clearAuthMethodHint(request, supabaseResponse)
}
} else {
const timeoutReason = evaluateSessionTimeout(
verifiedState,
timeoutConfig,
)
if (timeoutReason) {
await signOutTimedOutSession(supabase)
return sessionTimeoutResponse(
request,
supabaseResponse,
timeoutReason,
verifiedState.method,
)
}
}
}
// ── API routes ──────────────────────────────────────────────────────────
// API routes authenticate themselves (requireAuth, API-key Bearer, cron
// secret, webhook signatures). Middleware runs on them for ONE reason: to
@@ -78,7 +162,7 @@ export async function updateSession(request: NextRequest) {
if (pathname.startsWith('/api')) {
const skipMfaGate = apiPathSkipsMfaGate(
pathname,
request.headers.get('authorization') !== null,
hasAuthorizationHeader,
)
if (!skipMfaGate && user && shouldEnforceMfa(user)) {
const { data: aal } =
@@ -300,6 +384,112 @@ export async function updateSession(request: NextRequest) {
return supabaseResponse
}
async function getSupabaseSessionId(
supabase: ReturnType<typeof createServerClient>,
): Promise<string | null> {
if (typeof supabase.auth.getClaims !== 'function') return null
try {
const { data } = await supabase.auth.getClaims()
return typeof data?.claims?.session_id === 'string'
? data.claims.session_id
: null
} catch (error) {
console.warn('[middleware] could not resolve Supabase session id', error)
return null
}
}
async function signOutTimedOutSession(
supabase: ReturnType<typeof createServerClient>,
): Promise<void> {
try {
await supabase.auth.signOut({ scope: 'local' })
} catch (error) {
console.warn('[middleware] timed-out session revocation failed', error)
}
}
function clearAuthMethodHint(
request: NextRequest,
response: NextResponse,
): void {
if (!request.cookies.has(SESSION_AUTH_METHOD_HINT_COOKIE)) return
request.cookies.delete(SESSION_AUTH_METHOD_HINT_COOKIE)
response.cookies.set(SESSION_AUTH_METHOD_HINT_COOKIE, '', {
path: '/',
maxAge: 0,
sameSite: 'lax',
secure: process.env.NODE_ENV === 'production',
})
}
function clearSessionTimeoutCookies(
request: NextRequest,
response: NextResponse,
): void {
if (request.cookies.has(SESSION_TIMEOUT_COOKIE)) {
request.cookies.delete(SESSION_TIMEOUT_COOKIE)
response.cookies.set(
SESSION_TIMEOUT_COOKIE,
'',
sessionTimeoutClearCookieOptions(),
)
}
clearAuthMethodHint(request, response)
}
function copyResponseCookies(from: NextResponse, to: NextResponse): void {
for (const cookie of from.cookies.getAll()) {
to.cookies.set(cookie)
}
}
function sessionTimeoutResponse(
request: NextRequest,
authResponse: NextResponse,
reason: SessionTimeoutReason,
method: SessionAuthMethod,
): NextResponse {
clearSessionTimeoutCookies(request, authResponse)
if (request.nextUrl.pathname.startsWith('/api')) {
const response = NextResponse.json(
{
error: {
code: 'SESSION_EXPIRED',
message: reason === 'idle'
? 'Sessionen har upphört på grund av inaktivitet.'
: 'Sessionen har upphört av säkerhetsskäl.',
message_en: reason === 'idle'
? 'The session expired due to inactivity.'
: 'The session expired for security reasons.',
reason,
},
},
{ status: 401 },
)
response.headers.set('X-Session-Timeout-Reason', reason)
response.headers.set('Cache-Control', 'no-store')
copyResponseCookies(authResponse, response)
return response
}
const url = new URL('/login', request.url)
url.searchParams.set('reason', reason)
url.searchParams.set('method', method)
const destination = safeReturnTo(
request.nextUrl.pathname + request.nextUrl.search,
'/',
)
if (destination !== '/') url.searchParams.set('next', destination)
const response = NextResponse.redirect(url)
response.headers.set('Cache-Control', 'no-store')
copyResponseCookies(authResponse, response)
return response
}
/**
* Which query parameter each auth page reads its post-auth destination from.
* /login reads `next` (app/(auth)/login/page.tsx), the MFA pages read