Skip to main content

Lack of multi-factor authentication

Need​

Implementation of multi-factor authentication for critical services

Context​

  • Usage of Go 1.16 for building high-performance and efficient applications
  • Usage of gin-gonic/gin for building web applications in Go
  • Usage of net/http for creating HTTP servers in a Node.js application

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()

	r.POST("/login", func(c *gin.Context) {
		username := c.PostForm("username")
		password := c.PostForm("password")

		// Check if the username and password are correct
		// This is just a dummy example, in real life you would query this information from your database
		if username == "admin" && password == "password" {
			c.JSON(http.StatusOK, gin.H{"status": "you are logged in"})
		} else {
			c.JSON(http.StatusUnauthorized, gin.H{"status": "unauthorized"})
		}
	})

	r.Run()
}

The above code is a simple login system using the Gin framework in Go. The system only requires a username and password to authenticate a user.

The vulnerability lies in the /login route handler. This handler only checks for the username and password to authenticate a user. If an attacker can compromise a user's account (for example, by guessing or stealing the password), they can easily access the system as that user.

This is because there is no multi-factor authentication (MFA) mechanism in place. MFA is a security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity for a login or other transaction.

Implementing MFA would significantly increase the security of this system, as even if an attacker compromises a user's password, they would still need to bypass the second layer of authentication, which could be a text message to the user's phone, a fingerprint scan, or a face recognition scan.

Steps​

  • Implement a multi-factor authentication mechanism for critical services.
  • Use a secure and reliable multi-factor authentication method, such as SMS verification, email verification, or hardware tokens.
  • Ensure that the multi-factor authentication is enforced for accessing sensitive resources and services.
  • Integrate the multi-factor authentication mechanism with the login process.
  • Verify the user's identity using at least two factors before granting access to critical resources.
  • Store and manage the multi-factor authentication credentials securely.
  • Regularly review and update the multi-factor authentication implementation to address any vulnerabilities or weaknesses.

Compliant code​

package main

import (
	"github.com/dgrijalva/jwt-go"
	"github.com/gin-gonic/gin"
	"net/http"
	"os"
	"time"
)

var (
	// This should be obtained from a secure environment variable or secret management system
	// Do not hardcode this in your application
	jwtSecret = []byte(os.Getenv("JWT_SECRET"))
)

func main() {
	r := gin.Default()

	r.POST("/login", func(c *gin.Context) {
		username := c.PostForm("username")
		password := c.PostForm("password")

		// Check if the username and password are correct
		// This is just a dummy example, in real life you would query this information from your database
		if username == "admin" && password == "password" {
			// Create a new token object, specifying signing method and the claims
			// you would like it to contain.
			token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
				"username": username,
				"nbf":      time.Now().Unix(),
			})

			// Sign and get the complete encoded token as a string using the secret
			tokenString, _ := token.SignedString(jwtSecret)

			c.JSON(http.StatusOK, gin.H{"token": tokenString})
		} else {
			c.JSON(http.StatusUnauthorized, gin.H{"status": "unauthorized"})
		}
	})

	r.Run()
}

The updated code now implements a JWT (JSON Web Token) based authentication mechanism. When the user logs in with the correct username and password, a JWT token is generated and returned to the user. This token contains the username and the time when the token was issued.

The JWT token is signed with a secret key to ensure its integrity. The secret key should be stored securely and not hardcoded in the application. In this example, it is obtained from an environment variable.

The user must include this token in the Authorization header of their subsequent requests to access protected resources. The server will verify the token's signature and the claims inside the token to authenticate the user.

This is a simple form of multi-factor authentication where something the user knows (username and password) is combined with something the user has (a valid JWT token).

Please note that this is a basic implementation and might need to be adjusted based on your specific requirements. For example, you might want to add more claims to the token, handle token expiration, or use a more secure signing method.

References​

Last updated on