שימוש במספר רנדומלי אמיתי לקוד אימות דוא"ל ובUUID כמזהה סשנים - מספריית crypto המובנית

https://nodejs.org/api/crypto.html#cryptorandomintmin-max-callback
https://nodejs.org/api/crypto.html#cryptorandomuuidoptions

Author: ShlomoCode

src/controllers/users.js

@@ -5,16 +5,9 @@ const bcrypt = require('bcrypt');
 const { zxcvbn } = require('@zxcvbn-ts/core');
 const ms = require('ms');
 const { validate: emailValidator } = require('deep-email-validator');
+const crypto = require('crypto');
 const emailSends = require('@services/email');
 
-/**
- * @returns number random in 5 digit in string format
- */
-function randomCode () {
-    const numberRandom = Math.floor((Math.random() * 5000), 0);
-    return numberRandom.toString().padStart(5, Math.floor(Math.random() * 10 + 1)).toString();
-}
-
 /**
  * נרמול כתובת מייל - הסרת נקודות מיותרות, מה שאחרי הפלוס, וכדומה
  * לצורך וידוא שהמייל לא רשום כבר
@@ -82,7 +75,7 @@ async function signup (req, res) {
         });
     }
 
-    const verifyEmailCode = randomCode();
+    const verifyEmailCode = crypto.randomInt(0, 99999);
     const userID = new mongoose.Types.ObjectId();
 
     const user = new User({
@@ -129,12 +122,13 @@ async function login (req, res) {
 
     const session = await Session.create({
         _id: new mongoose.Types.ObjectId(),
+        uuid: crypto.randomUUID(),
         userId: user._id
     });
 
-    res.status(200).cookie('session', session._id, { path: '/', secure: true, httpOnly: true, maxAge: ms('30d') }).json({
+    res.status(200).cookie('session', session.uuid, { path: '/', secure: true, httpOnly: true, maxAge: ms('30d') }).json({
         message: 'Auth successful',
-        sessionId: session._id,
+        sessionUuid: session.uuid,
         user: {
             name: user.name,
             email: user.emailFront,
@@ -220,35 +214,8 @@ async function resendVerificationEmail (req, res) {
 async function resetPassword (req, res) {
     const { email } = req.body;
 
-    /**
-         * normalize-email by regex
-         */
     const emailProcessed = normalizeEmail(email);
 
-    /**
-        * validate email
-        */
-    const validateEmail = await emailValidator({
-        email: emailProcessed,
-        validateRegex: true,
-        validateMx: true,
-        validateTypo: false,
-        validateDisposable: true,
-        validateSMTP: false
-    });
-
-    if (!validateEmail.valid) {
-        if (validateEmail.reason === 'disposable') {
-            return res.status(400).json({
-                message: 'disposable email not allowed'
-            });
-        } else {
-            return res.status(400).json({
-                message: 'email is not valid'
-            });
-        }
-    }
-
     const user = await User.findOne({ emailProcessed });
     if (!user) {
         return res.status(404).json({
@@ -264,7 +231,7 @@ async function resetPassword (req, res) {
         });
     }
 
-    const resetPasswordToken = randomCode();
+    const resetPasswordToken = crypto.randomInt(0, 99999);
     await emailSends.resetPassword({
         code: resetPasswordToken,
         address: user.emailFront,

src/middlewares/checkLogin.js

@@ -2,12 +2,12 @@ const User = require('@models/user');
 const Session = require('@models/session');
 
 const checkLogin = async (req, res, next) => {
-    let sessionId = req.cookies.session || req.headers.authorization;
-    if (!sessionId) return res.status(401).header('action-required', 'login').json({ message: 'session is required. please login' });
+    let sessionUuid = req.cookies.session || req.headers.authorization;
+    if (!sessionUuid) return res.status(401).header('action-required', 'login').json({ message: 'session is required. please login' });
 
-    sessionId = sessionId.replace('Bearer ', '');
+    sessionUuid = sessionUuid.replace('Bearer ', '');
 
-    const session = await Session.findById(sessionId);
+    const session = await Session.findOne({ uuid: sessionUuid });
     if (!session) {
         if (req.url !== '/logout') res.header('action-required', 'login');
         return res.clearCookie('session').status(401).json({
@@ -24,7 +24,7 @@ const checkLogin = async (req, res, next) => {
     }
 
     res.locals.user = user;
-    res.locals.sessionId = sessionId;
+    res.locals.sessionId = session._id;
     next();
 };
 

src/models/session.js

@@ -2,6 +2,7 @@ const mongoose = require('mongoose');
 
 const sessionSchema = mongoose.Schema({
     _id: mongoose.Schema.Types.ObjectId,
+    uuid: { type: String, required: true },
     userId: { type: mongoose.Schema.Types.ObjectId, required: true },
     createdAt: { type: Date, default: Date.now },
     expires: { type: Date, default: Date.now, expires: 60 * 60 * 24 * 45 } // 45 days