From 22fbca36e26694a8b0d1ff28821307964b508fd9 Mon Sep 17 00:00:00 2001 From: danny Date: Wed, 12 Sep 2018 12:46:57 -0700 Subject: [PATCH 1/2] allow 'created_at' to be passed in to 'encode()' to make output deterministic for testing --- multipassify.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/multipassify.js b/multipassify.js index e82a818..6b261ef 100644 --- a/multipassify.js +++ b/multipassify.js @@ -19,7 +19,9 @@ multipassify.prototype.encode = function(obj) { // Store the current time in ISO8601 format. // The token will only be valid for a small timeframe around this timestamp. - obj["created_at"] = new Date().toISOString(); + if (!obj["created_at"]) { + obj["created_at"] = new Date().toISOString(); + } // Serialize the customer data to JSON and encrypt it var cipherText = this.encrypt(JSON.stringify(obj)); From 5731849754c3d76083008a238727ae9ab8e1dca0 Mon Sep 17 00:00:00 2001 From: danny Date: Wed, 12 Sep 2018 13:15:43 -0700 Subject: [PATCH 2/2] accept an optional IV as input to make testing deterministic --- multipassify.js | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/multipassify.js b/multipassify.js index 6b261ef..b0a96f7 100644 --- a/multipassify.js +++ b/multipassify.js @@ -14,7 +14,7 @@ var multipassify = module.exports = function(secret) { return this; }; -multipassify.prototype.encode = function(obj) { +multipassify.prototype.encode = function(obj, iv) { if (!obj) return; // Store the current time in ISO8601 format. @@ -24,7 +24,7 @@ multipassify.prototype.encode = function(obj) { } // Serialize the customer data to JSON and encrypt it - var cipherText = this.encrypt(JSON.stringify(obj)); + var cipherText = this.encrypt(JSON.stringify(obj), iv); // Create a signature (message authentication code) of the ciphertext // and encode everything using URL-safe Base64 (RFC 4648) @@ -35,9 +35,9 @@ multipassify.prototype.encode = function(obj) { return token; }; -multipassify.prototype.generateUrl = function(obj, domain) { +multipassify.prototype.generateUrl = function(obj, domain, iv) { if(!domain) return; - return "https://" + domain + "/account/login/multipass/" + this.encode(obj); + return "https://" + domain + "/account/login/multipass/" + this.encode(obj, iv); }; multipassify.prototype.sign = function (data) { @@ -45,9 +45,11 @@ multipassify.prototype.sign = function (data) { return signed; } -multipassify.prototype.encrypt = function(plaintext) { +multipassify.prototype.encrypt = function(plaintext, iv) { // Use a random IV - var iv = crypto.randomBytes(BLOCK_SIZE); + if(!iv) { + iv = crypto.randomBytes(BLOCK_SIZE); + } var cipher = crypto.createCipheriv('aes-128-cbc', this._encryptionKey,iv); // Use IV as first block of ciphertext