CSRFトークンの追加

src/Site/Controller/User.php

@@ -18,10 +18,16 @@ class User {
         exit();
       }
 
-      $doLogin = count($_POST) > 0;
+      $doLogin = $_SERVER['REQUEST_METHOD'] === 'POST';
       $error = '';
 
       if ($doLogin) {
+        if (!\verify_csrf_token($_POST['csrf_token'])) {
+          header('Location: /');
+          exit();
+        }
+        unset($_POST['csrf_token']);
+
         $a = [];
         if (count($_POST) === 2) {
           $i = 0;
@@ -91,6 +97,12 @@ class User {
       $nyuE = '';
 
       if ($doRegister) {
+        if (!\verify_csrf_token($_POST['csrf_token'])) {
+          header('Location: /');
+          exit();
+        }
+        unset($_POST['csrf_token']);
+
         $a = [];
         if (count($_POST) === 4) {
           $i = 0;

src/Site/Lib/Auth.php

@@ -51,17 +51,6 @@ class Auth {
     }
 
     $userData = $this->purgeOldTokens($userData);
-    $expire = 0;
-    $tokenExist = false;
-
-    foreach ($userData->tokens as $t) {
-      if ($t->ip === $ip) {
-        $tokenExist = true;
-        break;
-      }
-    }
-
-    if (!$tokenExist) {
     $token = bin2hex(random_bytes(64));
     $expire = time() + $this->tokenDuration;
     $newToken = [
@@ -74,7 +63,6 @@ class Auth {
     ];
 
     $userData->tokens[] = $newToken;
-    }
 
     $path = $this->dataDir.$this->id.'.'.$userData->username.'.json';
     $json = json_encode($userData, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
@@ -83,21 +71,16 @@ class Auth {
       return \Result::error('エラー：ユーザーデータの保存に失敗。');
     }
 
-    if (!$tokenExist) {
-      $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
-      $domain = $_SERVER['SERVER_NAME'];
-
     if (!setcookie('kerozen', $token, [
       'expires' => $expire,
       'path' => '/',
-        'domain' => $domain,
+      'domain' => $_SERVER['SERVER_NAME'],
-        'secure' => $secure,
+      'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
       'httponly' => true,
       'samesite' => 'Strict'
     ])) {
       return \Result::error('エラー：クッキーを設定に失敗。');
     }
-    }
 
     return \Result::success('ログイン成功');
   }
@@ -111,8 +94,6 @@ class Auth {
 
   public function logout(?string $token = null): \Result {
     if (!AUTH_ENABLED) return \Result::Error('エラー：認証システムは無効です。');
-    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
-    $domain = $_SERVER['SERVER_NAME'];
     $userData = $this->getUserData();
 
     if (!$token) {
@@ -124,8 +105,8 @@ class Auth {
     setcookie('kerozen', null, [
       'expires' => 0,
       'path' => '/',
-      'domain' => $domain,
+      'domain' => $_SERVER['SERVER_NAME'],
-      'secure' => $secure,
+      'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
       'httponly' => true,
       'samesite' => 'Strict'
     ]);

util.php

@@ -160,6 +160,24 @@ if (AUTH_ENABLED) {
 
     return $color.$suffix;
   }
+
+  function make_csrf_token(?bool $force = false): string {
+    if (null !== getcookie('csrf_token') && !$force) return getcookie('csrf_token');
+    $token = bin2hex(random_bytes(32));
+    setcookie('csrf_token', $token, [
+      'expires' => time() + 300, // 5分
+      'path' => '/',
+      'domain' => $_SERVER['SERVER_NAME'],
+      'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
+      'httponly' => true,
+      'samesite' => 'Strict'
+    ]);
+    return $token;
+  }
+
+  function verify_csrf_token(string $token): bool {
+    return hash_equals(getcookie('csrf_token'), $token);
+  }
 }
 
 function count_special_chars(string $str): int {

view/login.maron

@@ -28,7 +28,10 @@
               </tr>
               <tr>
                 <td></td>
-                <td><button>サインイン</button></td>
+                <td>
+                  <input type="hidden" id="csrf_token" name="csrf_token" value="{{ make_csrf_token() }}" />
+                  <button>サインイン</button>
+                </td>
               </tr>
             </tbody>
           </table>

view/register.maron

@@ -38,7 +38,10 @@
               </tr>
               <tr>
                 <td></td>
-                <td><button>登録</button></td>
+                <td>
+                  <input type="hidden" id="csrf_token" name="csrf_token" value="{{ make_csrf_token() }}" />
+                  <button>登録</button>
+                </td>
               </tr>
             </tbody>
           </table>