@@ -10777,8 +10873,6 @@ class AccountManager {
document.body.appendChild(container);
}
- const passwordValue = user?.Password || '';
- const hasReadablePassword = user?.PasswordAvailable === true || Boolean(passwordValue);
const usernameEl = document.getElementById('userDetailUsername');
const fullNameEl = document.getElementById('userDetailFullName');
const emailEl = document.getElementById('userDetailEmail');
@@ -10786,9 +10880,6 @@ class AccountManager {
const statusEl = document.getElementById('userDetailStatus');
const createdDateEl = document.getElementById('userDetailCreatedDate');
const lastLoginEl = document.getElementById('userDetailLastLogin');
- const passwordEl = document.getElementById('userDetailPassword');
- const passwordToggleBtn = document.getElementById('userDetailPasswordToggle');
- const passwordToggleIcon = document.getElementById('userDetailPasswordToggleIcon');
const editBtn = document.getElementById('userDetailEditBtn');
const detailsModal = document.getElementById('userDetailsModal');
@@ -10799,35 +10890,6 @@ class AccountManager {
if (statusEl) statusEl.textContent = user?.IsActive ? 'Active' : 'Inactive';
if (createdDateEl) createdDateEl.textContent = this.formatDateTime(user?.CreatedDate);
if (lastLoginEl) lastLoginEl.textContent = this.formatDateTime(user?.LastLogin);
- if (passwordEl) {
- passwordEl.dataset.password = passwordValue;
- passwordEl.dataset.visible = 'false';
- passwordEl.textContent = hasReadablePassword ? '********' : '(khong the hien thi - can reset password 1 lan)';
- }
-
- if (passwordToggleBtn && passwordEl) {
- passwordToggleBtn.addEventListener('click', () => {
- if (!hasReadablePassword) {
- return;
- }
- const isVisible = passwordEl.dataset.visible === 'true';
- if (isVisible) {
- passwordEl.textContent = '********';
- passwordEl.dataset.visible = 'false';
- if (passwordToggleIcon) passwordToggleIcon.textContent = 'visibility';
- } else {
- passwordEl.textContent = passwordValue;
- passwordEl.dataset.visible = 'true';
- if (passwordToggleIcon) passwordToggleIcon.textContent = 'visibility_off';
- }
- });
- }
-
- if (passwordToggleBtn && !hasReadablePassword) {
- passwordToggleBtn.disabled = true;
- passwordToggleBtn.classList.add('opacity-50', 'cursor-not-allowed');
- }
-
if (editBtn) {
editBtn.addEventListener('click', () => {
closeUserDetailsModal();
@@ -11148,6 +11210,18 @@ function closeProfileModal() {
// Initialize app when DOM is ready
let app;
-document.addEventListener('DOMContentLoaded', () => {
- app = new AccountManager();
+document.addEventListener('DOMContentLoaded', async () => {
+ try {
+ const response = await fetch('/api/auth/session', { cache: 'no-store' });
+ const data = await response.json();
+ if (!response.ok || !data.success || !data.user) {
+ throw new Error('Session is not valid');
+ }
+
+ localStorage.setItem('currentUser', JSON.stringify(data.user));
+ app = new AccountManager();
+ } catch (error) {
+ localStorage.removeItem('currentUser');
+ window.location.replace('../pages/login.html?reason=session-expired');
+ }
});
diff --git a/public/modals.html b/public/modals.html
index 9d8389d..2226ad2 100644
--- a/public/modals.html
+++ b/public/modals.html
@@ -119,7 +119,7 @@
-
+
diff --git a/public/pages/index.html b/public/pages/index.html
index e67a4b4..13b8bf3 100644
--- a/public/pages/index.html
+++ b/public/pages/index.html
@@ -12,7 +12,7 @@
-
+
-
+
diff --git a/public/pages/login.html b/public/pages/login.html
index 26c3ef0..1dcf97d 100644
--- a/public/pages/login.html
+++ b/public/pages/login.html
@@ -194,6 +194,8 @@
id="resetPassword"
name="resetPassword"
placeholder="Enter a new password"
+ minlength="12"
+ maxlength="256"
required
class="w-full pl-10 pr-4 py-2.5 bg-surface-container-low border border-outline-variant/30 rounded-lg focus:ring-2 focus:ring-primary focus:border-transparent transition-all text-sm font-medium"
/>
@@ -211,6 +213,8 @@
id="resetConfirmPassword"
name="resetConfirmPassword"
placeholder="Re-enter new password"
+ minlength="12"
+ maxlength="256"
required
class="w-full pl-10 pr-4 py-2.5 bg-surface-container-low border border-outline-variant/30 rounded-lg focus:ring-2 focus:ring-primary focus:border-transparent transition-all text-sm font-medium"
/>
@@ -294,6 +298,8 @@
id="regPassword"
name="password"
placeholder="Create a password"
+ minlength="12"
+ maxlength="256"
required
class="w-full pl-10 pr-4 py-2.5 bg-surface-container-low border border-outline-variant/30 rounded-lg focus:ring-2 focus:ring-primary focus:border-transparent transition-all text-sm font-medium"
/>
@@ -314,7 +320,7 @@
@@ -419,13 +425,37 @@
return 'login';
};
- document.addEventListener('DOMContentLoaded', () => {
- const initialMode = getInitialMode();
- const currentUser = localStorage.getItem('currentUser');
- if (currentUser && initialMode !== 'reset') {
- window.location.href = './index.html';
- return;
+ document.addEventListener('DOMContentLoaded', async () => {
+ let initialMode = getInitialMode();
+ try {
+ const configResponse = await fetch('/api/auth/config', { cache: 'no-store' });
+ const config = await configResponse.json();
+ if (configResponse.ok && config.allowSelfRegistration === false) {
+ registerTab.classList.add('hidden');
+ if (initialMode === 'register') {
+ initialMode = 'login';
+ }
+ }
+ } catch (error) {
+ registerTab.classList.add('hidden');
+ if (initialMode === 'register') {
+ initialMode = 'login';
+ }
}
+ if (initialMode !== 'reset') {
+ try {
+ const sessionResponse = await fetch('/api/auth/session', { cache: 'no-store' });
+ const sessionData = await sessionResponse.json();
+ if (sessionResponse.ok && sessionData.success && sessionData.user) {
+ localStorage.setItem('currentUser', JSON.stringify(sessionData.user));
+ window.location.replace('./index.html');
+ return;
+ }
+ } catch (error) {
+ console.debug('No active session');
+ }
+ }
+ localStorage.removeItem('currentUser');
setMode(initialMode);
@@ -490,7 +520,7 @@
headers: {
'Content-Type': 'application/json'
},
- body: JSON.stringify({ username, password })
+ body: JSON.stringify({ username, password, remember: rememberCheckbox.checked })
});
const data = await response.json();
@@ -579,8 +609,8 @@
return;
}
- if (!newPassword || newPassword.length < 6) {
- resetPasswordErrorMessage.textContent = 'New password must be at least 6 characters.';
+ if (!newPassword || newPassword.length < 12 || newPassword.length > 256) {
+ resetPasswordErrorMessage.textContent = 'New password must be between 12 and 256 characters.';
resetPasswordErrorMessage.classList.remove('hidden');
return;
}
diff --git a/test/security.test.js b/test/security.test.js
new file mode 100644
index 0000000..05baa55
--- /dev/null
+++ b/test/security.test.js
@@ -0,0 +1,97 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+process.env.NODE_ENV = 'test';
+process.env.DATA_ENCRYPTION_SECRET = 'test-only-encryption-secret-with-more-than-32-characters';
+
+const {
+ app,
+ encryptSensitiveValue,
+ decryptSensitiveValue,
+ hashSessionToken,
+ normalizeOptionalHttpUrl
+} = require('../backend/server');
+
+async function withTestServer(run) {
+ const server = app.listen(0, '127.0.0.1');
+ await new Promise((resolve, reject) => {
+ server.once('listening', resolve);
+ server.once('error', reject);
+ });
+
+ try {
+ const address = server.address();
+ await run(`http://127.0.0.1:${address.port}`);
+ } finally {
+ await new Promise(resolve => server.close(resolve));
+ }
+}
+
+test('stored credentials use authenticated encryption and round-trip safely', () => {
+ const plainText = 'example-password-value';
+ const first = encryptSensitiveValue(plainText);
+ const second = encryptSensitiveValue(plainText);
+
+ assert.match(first, /^enc:v2:/);
+ assert.notEqual(first, second);
+ assert.equal(first.includes(plainText), false);
+ assert.equal(decryptSensitiveValue(first), plainText);
+ assert.equal(decryptSensitiveValue(`${first}tampered`), null);
+});
+
+test('session tokens are stored as deterministic SHA-256 hashes', () => {
+ const token = 'a-private-random-session-token';
+ const hash = hashSessionToken(token);
+
+ assert.match(hash, /^[a-f0-9]{64}$/);
+ assert.equal(hash, hashSessionToken(token));
+ assert.equal(hash.includes(token), false);
+});
+
+test('application URLs accept only HTTP and HTTPS protocols', () => {
+ assert.equal(normalizeOptionalHttpUrl(''), '');
+ assert.equal(normalizeOptionalHttpUrl('javascript:alert(1)'), null);
+ assert.equal(normalizeOptionalHttpUrl('file:///etc/passwd'), null);
+ assert.match(normalizeOptionalHttpUrl('https://example.com/path'), /^https:\/\/example\.com\/path/);
+});
+
+test('forged legacy identity headers cannot bypass protected APIs', async () => {
+ await withTestServer(async baseUrl => {
+ const response = await fetch(`${baseUrl}/api/users`, {
+ headers: {
+ 'x-user-id': '1',
+ 'x-user-role': 'admin'
+ }
+ });
+ const body = await response.json();
+
+ assert.equal(response.status, 401);
+ assert.equal(body.success, false);
+ });
+});
+
+test('security headers and no-store API caching are enabled', async () => {
+ await withTestServer(async baseUrl => {
+ const response = await fetch(`${baseUrl}/api/health`);
+
+ assert.equal(response.status, 200);
+ assert.match(response.headers.get('content-security-policy') || '', /default-src 'self'/);
+ assert.equal(response.headers.get('x-powered-by'), null);
+ assert.equal(response.headers.get('cache-control'), 'no-store');
+ });
+});
+
+test('state-changing requests from untrusted origins are rejected before route handling', async () => {
+ await withTestServer(async baseUrl => {
+ const response = await fetch(`${baseUrl}/api/auth/login`, {
+ method: 'POST',
+ headers: {
+ Origin: 'https://attacker.example',
+ 'Content-Type': 'application/json'
+ },
+ body: JSON.stringify({ username: 'test', password: 'not-a-real-password' })
+ });
+
+ assert.equal(response.status, 403);
+ });
+});