From 388cd11b4c462389a1186f640ac28204f80f2fb3 Mon Sep 17 00:00:00 2001 From: Ylian Saint-Hilaire Date: Mon, 26 Aug 2019 14:43:15 -0700 Subject: [PATCH] Fixed reverse-proxy problems with TLS offload. --- package.json | 2 +- views/default-mobile-min.handlebars | 2 +- views/login-min.handlebars | 2 +- views/login-mobile-min.handlebars | 2 +- views/login.handlebars | 9 ++++++--- webserver.js | 2 +- 6 files changed, 11 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index abeec045..3c265e8c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "meshcentral", - "version": "0.4.0-h", + "version": "0.4.0-i", "keywords": [ "Remote Management", "Intel AMT", diff --git a/views/default-mobile-min.handlebars b/views/default-mobile-min.handlebars index 038ce246..525bc6b1 100644 --- a/views/default-mobile-min.handlebars +++ b/views/default-mobile-min.handlebars @@ -1 +1 @@ - {{{title}}}
{{{title}}}
{{{title2}}}
\ No newline at end of file + {{{title}}}
{{{title}}}
{{{title2}}}
\ No newline at end of file diff --git a/views/login-min.handlebars b/views/login-min.handlebars index a1feed00..637baded 100644 --- a/views/login-min.handlebars +++ b/views/login-min.handlebars @@ -1 +1 @@ - {{{title}}} - Login
{{{title}}}
{{{title2}}}
♦

Welcome


\ No newline at end of file + {{{title}}} - Login
{{{title}}}
{{{title2}}}
♦

Welcome


\ No newline at end of file diff --git a/views/login-mobile-min.handlebars b/views/login-mobile-min.handlebars index b0740e78..f0ebf2cc 100644 --- a/views/login-mobile-min.handlebars +++ b/views/login-mobile-min.handlebars @@ -1 +1 @@ - MeshCentral - Login
{{{title}}}
{{{title2}}}
\ No newline at end of file + MeshCentral - Login
{{{title}}}
{{{title2}}}
\ No newline at end of file diff --git a/views/login.handlebars b/views/login.handlebars index bdbd7f9c..386ed528 100644 --- a/views/login.handlebars +++ b/views/login.handlebars @@ -272,6 +272,7 @@ var uiMode = parseInt(getstore('uiMode', '1')); var webPageFullScreen = true; var nightMode = (getstore('_nightMode', '0') == '1'); + var publicKeyCredentialRequestOptions = null; // If URL arguments are provided, add them to form posts if (window.location.href.indexOf('?') > 0) { @@ -329,7 +330,7 @@ if ((hardwareKeyChallenge != null) && (hardwareKeyChallenge.type == 'webAuthn')) { hardwareKeyChallenge.challenge = Uint8Array.from(atob(hardwareKeyChallenge.challenge), function (c) { return c.charCodeAt(0) }).buffer; - var publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout } + publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout } for (var i = 0; i < hardwareKeyChallenge.keyIds.length; i++) { publicKeyCredentialRequestOptions.allowCredentials.push( { id: Uint8Array.from(atob(hardwareKeyChallenge.keyIds[i]), function (c) { return c.charCodeAt(0) }), type: 'public-key', transports: ['usb', 'ble', 'nfc'], } @@ -350,7 +351,9 @@ QE('tokenOkButton', true); Q('tokenOkButton').click(); }, - function (error) { console.log('credentials-get error', error); } + function (error) { + console.log('credentials-get error', error); + } ); } } @@ -360,7 +363,7 @@ if ((hardwareKeyChallenge != null) && (hardwareKeyChallenge.type == 'webAuthn')) { hardwareKeyChallenge.challenge = Uint8Array.from(atob(hardwareKeyChallenge.challenge), function (c) { return c.charCodeAt(0) }).buffer; - var publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout } + publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout } for (var i = 0; i < hardwareKeyChallenge.keyIds.length; i++) { publicKeyCredentialRequestOptions.allowCredentials.push( { id: Uint8Array.from(atob(hardwareKeyChallenge.keyIds[i]), function (c) { return c.charCodeAt(0) }), type: 'public-key', transports: ['usb', 'ble', 'nfc'], } diff --git a/webserver.js b/webserver.js index f2722f91..b3869fec 100644 --- a/webserver.js +++ b/webserver.js @@ -3131,7 +3131,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) { name: 'xid', // Recommended security practice to not use the default cookie name httpOnly: true, keys: [obj.args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances - secure: (obj.args.notls != true) // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html) + secure: ((obj.args.notls != true) && (obj.args.tlsoffload == null)) // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html) } if (obj.args.sessionsamesite != null) { sessionOptions.sameSite = obj.args.sessionsamesite; } if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60 * 1000); }