NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: persistent sessiebeheer (remember-me), HTTPS-cookie herstel en Microsoft OAuth signed state flow

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-08 15:28:57 +02:00
parent e1f50740aa
commit acef94536d
12 changed files with 278 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/callback_microsoft.php
+38 -6
View File
@@ -7,22 +7,54 @@
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/integrations/microsoft.php';
$user = require_auth();
start_secure_session();
// 1. CSRF State validatie & Sessieherstel
$receivedState = $_GET['state'] ?? '';
$stateUserId = !empty($receivedState) ? verify_oauth_state($receivedState) : null;
// Als de sessie verloren is gegaan tijdens de externe cross-site redirect vanaf Microsoft,
// herstellen we de gebruiker veilig aan de hand van de cryptografisch ondertekende OAuth state!
if (empty($_SESSION['user_id']) && $stateUserId) {
try {
$db = get_db_connection();
$stmtUser = $db->prepare("SELECT id, name, email, role, two_factor_enabled, created_at FROM users WHERE id = ?");
$stmtUser->execute([$stateUserId]);
$recoveredUser = $stmtUser->fetch();
if ($recoveredUser) {
$_SESSION['user_id'] = $recoveredUser['id'];
$_SESSION['user_name'] = $recoveredUser['name'];
$_SESSION['user_email'] = $recoveredUser['email'];
$_SESSION['user_role'] = $recoveredUser['role'];
$_SESSION['is_2fa_verified'] = true;
issue_remember_token((int)$recoveredUser['id']);
}
} catch (Throwable $e) {
// Foutafhandeling
}
}
// 2. Controleer authenticatie
$user = get_logged_in_user();
if (!$user) {
header('Location: /auth/login.php?error=' . urlencode('Sessie verlopen tijdens Microsoft koppeling. Log opnieuw in en probeer het nogmaals.'));
exit;
}
$db = get_db_connection();
// 1. Foutafhandeling vanuit Microsoft
// 3. Foutafhandeling vanuit Microsoft (bijv. gebruiker weigerde machtiging)
if (!empty($_GET['error'])) {
$errorDescription = $_GET['error_description'] ?? $_GET['error'];
header('Location: /integrations.php?error=' . urlencode("Microsoft melding: {$errorDescription}"));
exit;
}
// 2. CSRF State validatie
$receivedState = $_GET['state'] ?? '';
// 4. Valideer de state (via HMAC handtekening of fallback sessiestate)
$expectedState = $_SESSION['ms_oauth_state'] ?? '';
unset($_SESSION['ms_oauth_state']);
unset($_SESSION['ms_oauth_state'], $_SESSION['ms_oauth_user_id']);
if (empty($receivedState) || !hash_equals($expectedState, $receivedState)) {
if (!$stateUserId && (empty($receivedState) || empty($expectedState) || !hash_equals($expectedState, $receivedState))) {
header('Location: /integrations.php?error=' . urlencode('Ongeldige sessie of CSRF-controle mislukt. Probeer opnieuw in te loggen via Microsoft.'));
exit;
}