Skip to content
This repository has been archived by the owner on Mar 1, 2024. It is now read-only.

Fixing security warnings. #163

Merged
merged 9 commits into from
Mar 19, 2023
Merged

Fixing security warnings. #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
72d773d
Putting ssl cert disabling behind a config flag so by default we will…
mcottontensor Mar 16, 2023
d57b7d8
Removing bad password storing example.
mcottontensor Mar 16, 2023
0539fd2
Handling exceptions on dyanmic method calls
mcottontensor Mar 16, 2023
948ceb9
Adding rate limiting to http requests
mcottontensor Mar 17, 2023
a7733b9
Fixing missing csrf security warning.
mcottontensor Mar 19, 2023
9823394
Merge branch 'master' of github.com:EpicGames/PixelStreamingInfrastru…
mcottontensor Mar 19, 2023
fe36617
Better fix for dynamic call security warning
mcottontensor Mar 19, 2023
504886b
Upping rate limit to 60 requests per min
mcottontensor Mar 19, 2023
eeeae3b
Adding warning message to disabled self signed certs
mcottontensor Mar 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 21 additions & 7 deletions SignallingWebServer/cirrus.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,8 @@ const defaultConfig = {
HttpsPort: 443,
StreamerPort: 8888,
SFUPort: 8889,
MaxPlayerCount: -1
MaxPlayerCount: -1,
DisableSSLCert: true
};

const argv = require('yargs').argv;
Expand Down Expand Up @@ -78,8 +79,11 @@ if (config.UseFrontend) {
var httpPort = 3000;
var httpsPort = 8000;

//Required for self signed certs otherwise just get an error back when sending request to frontend see https://stackoverflow.com/a/35633993
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
if (config.UseHTTPS && config.DisableSSLCert) {
//Required for self signed certs otherwise just get an error back when sending request to frontend see https://stackoverflow.com/a/35633993
console.warn('WARNING: config.DisableSSLCert is true. Unauthorized SSL certificates will be allowed! This is convenient for local testing but please DO NOT SHIP THIS IN PRODUCTION. To remove this warning please set DisableSSLCert to false in your config.json.');
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
}
lukehb marked this conversation as resolved.
Show resolved Hide resolved

const httpsClient = require('./modules/httpsClient.js');
var webRequest = new httpsClient();
Expand Down Expand Up @@ -189,6 +193,16 @@ if (config.UseHTTPS) {

sendGameSessionData();

// set up rate limiter: maximum of five requests per minute
var RateLimit = require('express-rate-limit');
var limiter = RateLimit({
windowMs: 1*60*1000, // 1 minute
max: 60
});

// apply rate limiter to all requests
app.use(limiter);

//Setup the login page if we are using authentication
if(config.UseAuthentication){
if(config.EnableWebserver) {
Expand Down Expand Up @@ -365,7 +379,6 @@ function logForward(srcName, destName, msg) {

let WebSocket = require('ws');

let streamerMessageHandlers = new Map();
let sfuMessageHandlers = new Map();
let playerMessageHandlers = new Map();

Expand Down Expand Up @@ -449,6 +462,7 @@ function forwardStreamerMessageToPlayer(streamer, msg) {
}
}

let streamerMessageHandlers = new Map();
streamerMessageHandlers.set('endpointId', onStreamerMessageId);
streamerMessageHandlers.set('ping', onStreamerMessagePing);
streamerMessageHandlers.set('offer', forwardStreamerMessageToPlayer);
Expand All @@ -475,7 +489,7 @@ streamerServer.on('connection', function (ws, req) {
}

let handler = streamerMessageHandlers.get(msg.type);
if (!handler) {
if (!handler || (typeof handler != 'function')) {
if (config.LogVerbose) {
console.logColor(logging.White, "\x1b[37m-> %s\x1b[34m: %s", streamer.id, msgRaw);
}
Expand Down Expand Up @@ -577,7 +591,7 @@ sfuServer.on('connection', function (ws, req) {
}

let handler = sfuMessageHandlers.get(msg.type);
if (!handler) {
if (!handler || (typeof handler != 'function')) {
if (config.LogVerbose) {
console.logColor(logging.White, "\x1b[37m-> %s\x1b[34m: %s", SFUPlayerId, msgRaw);
}
Expand Down Expand Up @@ -718,7 +732,7 @@ playerServer.on('connection', function (ws, req) {
}

let handler = playerMessageHandlers.get(msg.type);
if (!handler) {
if (!handler || (typeof handler != 'function')) {
if (config.LogVerbose) {
console.logColor(logging.White, "\x1b[37m-> %s\x1b[34m: %s", playerId, msgRaw);
}
Expand Down
80 changes: 0 additions & 80 deletions SignallingWebServer/modules/authentication/db/store_password.js
View file
Open in desktop

This file was deleted.

3 changes: 3 additions & 0 deletions SignallingWebServer/modules/authentication/init.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ const bcrypt = require('bcryptjs');
const LocalStrategy = require('passport-local').Strategy;
const path = require('path');
const fs = require('fs');
const csrf = require('lusca').csrf;
var db = require('./db');

function initPassport (app) {
Expand All @@ -33,6 +34,8 @@ function initPassport (app) {
fs.writeFileSync(configPath, content);
}

app.use(csrf());

// Setup session id settings
app.use(session({
secret: config.sessionSecret,
Expand Down
51 changes: 51 additions & 0 deletions SignallingWebServer/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions SignallingWebServer/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,10 @@
"dependencies": {
"bcryptjs": "^2.4.3",
"express": "^4.18.2",
"express-rate-limit": "^6.7.0",
"express-session": "^1.15.6",
"helmet": "^3.21.3",
"lusca": "^1.7.0",
"passport": "^0.6.0",
"passport-local": "^1.0.0",
"run-script-os": "^1.1.6",
Expand Down