Merge pull request #17575 from nextcloud/bugfix/noid/expect-nonce

fix(hostedhpb): Expect nonce on request

Author: nickvergessen

lib/Controller/HostedSignalingServerController.php

@@ -15,8 +15,10 @@
 use OCA\Talk\Service\HostedSignalingServerService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\ApiRoute;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
 use OCP\AppFramework\Http\Attribute\PublicPage;
+use OCP\AppFramework\Http\Attribute\RequestHeader;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
 use OCP\Http\Client\IClientService;
@@ -42,28 +44,44 @@ public function __construct(
 	/**
 	 * Get the authentication credentials
 	 *
-	 * @return DataResponse<Http::STATUS_OK, array{nonce: string}, array{}>|DataResponse<Http::STATUS_PRECONDITION_FAILED, null, array{}>
+	 * @return DataResponse<Http::STATUS_OK, array{nonce: string}, array{}>|DataResponse<Http::STATUS_FORBIDDEN|Http::STATUS_PRECONDITION_FAILED, null, array{}>
 	 *
 	 * 200: Authentication credentials returned
+	 * 403: Provided nonce is wrong
 	 * 412: Getting authentication credentials is not possible
 	 */
 	#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
 	#[PublicPage]
+	#[BruteForceProtection(action: 'hosted-hpb-nonce')]
+	#[RequestHeader(name: 'x-account-service-nonce', description: 'Random string provided to the hostedsignalingserver entity, so it can verify that it was requested')]
 	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/hostedsignalingserver/auth', requirements: [
 		'apiVersion' => '(v1)',
 	])]
 	public function auth(): DataResponse {
+		$sentNonce = $this->request->getHeader('x-account-service-nonce');
+		if ($sentNonce === '') {
+			$response = new DataResponse(null, Http::STATUS_FORBIDDEN);
+			$response->throttle();
+			return $response;
+		}
+
 		$storedNonce = $this->config->getAppValue('spreed', 'hosted-signaling-server-nonce', '');
-		// reset nonce after one request
-		$this->config->deleteAppValue('spreed', 'hosted-signaling-server-nonce');
+		if ($storedNonce === '') {
+			return new DataResponse(null, Http::STATUS_PRECONDITION_FAILED);
+		}
 
-		if ($storedNonce !== '') {
-			return new DataResponse([
-				'nonce' => $storedNonce,
-			]);
+		if (!hash_equals($storedNonce, $sentNonce)) {
+			$response = new DataResponse(null, Http::STATUS_FORBIDDEN);
+			$response->throttle();
+			return $response;
 		}
 
-		return new DataResponse(null, Http::STATUS_PRECONDITION_FAILED);
+		// reset nonce after one request
+		$this->config->deleteAppValue('spreed', 'hosted-signaling-server-nonce');
+
+		return new DataResponse([
+			'nonce' => $storedNonce,
+		]);
 	}
 
 	/**