Merge pull request #17581 from nextcloud/backport/17575/stable31

[stable31] fix(hostedhpb): Expect nonce on request

Author: nickvergessen

lib/Controller/HostedSignalingServerController.php

@@ -14,6 +14,7 @@
 use OCA\Talk\Exceptions\HostedSignalingServerInputException;
 use OCA\Talk\Service\HostedSignalingServerService;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
 use OCP\AppFramework\Http\Attribute\PublicPage;
 use OCP\AppFramework\Http\DataResponse;
@@ -41,25 +42,40 @@ public function __construct(
 	/**
 	 * Get the authentication credentials
 	 *
-	 * @return DataResponse<Http::STATUS_OK, array{nonce: string}, array{}>|DataResponse<Http::STATUS_PRECONDITION_FAILED, null, array{}>
+	 * @return DataResponse<Http::STATUS_OK, array{nonce: string}, array{}>|DataResponse<Http::STATUS_FORBIDDEN|Http::STATUS_PRECONDITION_FAILED, null, array{}>
 	 *
 	 * 200: Authentication credentials returned
+	 * 403: Provided nonce is wrong
 	 * 412: Getting authentication credentials is not possible
 	 */
 	#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
 	#[PublicPage]
+	#[BruteForceProtection(action: 'hosted-hpb-nonce')]
 	public function auth(): DataResponse {
+		$sentNonce = $this->request->getHeader('x-account-service-nonce');
+		if ($sentNonce === '') {
+			$response = new DataResponse(null, Http::STATUS_FORBIDDEN);
+			$response->throttle();
+			return $response;
+		}
+
 		$storedNonce = $this->config->getAppValue('spreed', 'hosted-signaling-server-nonce', '');
-		// reset nonce after one request
-		$this->config->deleteAppValue('spreed', 'hosted-signaling-server-nonce');
+		if ($storedNonce === '') {
+			return new DataResponse(null, Http::STATUS_PRECONDITION_FAILED);
+		}
 
-		if ($storedNonce !== '') {
-			return new DataResponse([
-				'nonce' => $storedNonce,
-			]);
+		if (!hash_equals($storedNonce, $sentNonce)) {
+			$response = new DataResponse(null, Http::STATUS_FORBIDDEN);
+			$response->throttle();
+			return $response;
 		}
 
-		return new DataResponse(null, Http::STATUS_PRECONDITION_FAILED);
+		// reset nonce after one request
+		$this->config->deleteAppValue('spreed', 'hosted-signaling-server-nonce');
+
+		return new DataResponse([
+			'nonce' => $storedNonce,
+		]);
 	}
 
 	/**