[pbs-devel] [PATCH proxmox-backup/widget-toolkit 0/2] opt PBS into the new HttpOnly flow for TFA challenges

[pbs-devel] [PATCH proxmox-backup/widget-toolkit 0/2] opt PBS into the new HttpOnly flow for TFA challenges

[Shannon Sterz]

these patches:

a) allow users of the TfaWindow to opt into the new HttpOnly auth flow
b) do so for PBS

this should fix a problem where log ins could became racy

proxmox-widget-toolkit:

Shannon Sterz (1):
  tfa window: allow opting into the new http only flow for tfa
    challenges

 src/window/TfaWindow.js | 4 ++++
 1 file changed, 4 insertions(+)


proxmox-backup:

Shannon Sterz (1):
  ui: login: opt the tfa challenge handling into the new HttpOnly flow

 www/LoginView.js | 2 ++
 1 file changed, 2 insertions(+)


Summary over all repositories:
  2 files changed, 6 insertions(+), 0 deletions(-)

--
Generated by git-murpp 0.8.1


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

[pbs-devel] [PATCH widget-toolkit 1/1] tfa window: allow opting into the new http only flow for tfa challenges

[Shannon Sterz]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/window/TfaWindow.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/window/TfaWindow.js b/src/window/TfaWindow.js
index c066f22..e3a73b5 100644
--- a/src/window/TfaWindow.js
+++ b/src/window/TfaWindow.js
@@ -301,6 +301,10 @@ Ext.define('Proxmox.window.TfaLoginWindow', {
                 password,
             };
 
+            if (view.http_only === true) {
+                params['http-only'] = true;
+            }
+
             let resolve = view.onResolve;
             let reject = view.onReject;
             view.close();
-- 
2.47.2



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

[pbs-devel] applied: [PATCH widget-toolkit 1/1] tfa window: allow opting into the new http only flow for tfa challenges

[Thomas Lamprecht]

On Wed, 06 Aug 2025 11:57:01 +0200, Shannon Sterz wrote:
> 


Applied, thanks!

[1/1] tfa window: allow opting into the new http only flow for tfa challenges
      commit: 230fb4d0d15b348253aa53cfe169d0066e4f1647


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

[pve-devel] applied: [pbs-devel] [PATCH widget-toolkit 1/1] tfa window: allow opting into the new http only flow for tfa challenges

[Thomas Lamprecht]

On Wed, 06 Aug 2025 11:57:01 +0200, Shannon Sterz wrote:
> 


Applied, thanks!

[1/1] tfa window: allow opting into the new http only flow for tfa challenges
      commit: 230fb4d0d15b348253aa53cfe169d0066e4f1647


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pbs-devel] [PATCH proxmox-backup 1/1] ui: login: opt the tfa challenge handling into the new HttpOnly flow

[Shannon Sterz]

this was missed previously leading to the tfa part of the auth flow
not opting into the new auth flow. this meant the server did not add a
Set-Cookie header. after that whether or not a login worked fine
became a race between the refresh logic (which was opted into the new
flow and, thus, would yield a proper HttpOnly cookie) and other
requests.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 www/LoginView.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/www/LoginView.js b/www/LoginView.js
index 9c1ac38a..cf6c2cf7 100644
--- a/www/LoginView.js
+++ b/www/LoginView.js
@@ -114,6 +114,7 @@ Ext.define('PBS.LoginView', {
 
             let userid = data.username;
             let ticket = data.ticket;
+            let http_only = true;
             let challenge = JSON.parse(
                 decodeURIComponent(ticket.split(':')[1].slice('!tfa!'.length)),
             );
@@ -123,6 +124,7 @@ Ext.define('PBS.LoginView', {
                     userid,
                     ticket,
                     challenge,
+                    http_only,
                     onResolve: (value) => resolve(value),
                     onReject: reject,
                 }).show();
-- 
2.47.2



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup 1/1] ui: login: opt the tfa challenge handling into the new HttpOnly flow

[Thomas Lamprecht]

On Wed, 06 Aug 2025 11:57:02 +0200, Shannon Sterz wrote:
> this was missed previously leading to the tfa part of the auth flow
> not opting into the new auth flow. this meant the server did not add a
> Set-Cookie header. after that whether or not a login worked fine
> became a race between the refresh logic (which was opted into the new
> flow and, thus, would yield a proper HttpOnly cookie) and other
> requests.
> 
> [...]

Applied, thanks!

tiny nit: we would prefer camelCase in JS, but that's just internal so we can
change it at any time with a fallback to the previous property.

[1/1] ui: login: opt the tfa challenge handling into the new HttpOnly flow
      commit: 4e7c0d6a264557e4e9eea3b0cae2a97260848469


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup 1/1] ui: login: opt the tfa challenge handling into the new HttpOnly flow

[Shannon Sterz]

On Wed Aug 6, 2025 at 12:09 PM CEST, Thomas Lamprecht wrote:
> On Wed, 06 Aug 2025 11:57:02 +0200, Shannon Sterz wrote:
>> this was missed previously leading to the tfa part of the auth flow
>> not opting into the new auth flow. this meant the server did not add a
>> Set-Cookie header. after that whether or not a login worked fine
>> became a race between the refresh logic (which was opted into the new
>> flow and, thus, would yield a proper HttpOnly cookie) and other
>> requests.
>>
>> [...]
>
> Applied, thanks!
>
> tiny nit: we would prefer camelCase in JS, but that's just internal so we can
> change it at any time with a fallback to the previous property.

yes sorry, noticed that after i send it, just send a follow-up. snake
case is too much of a habbit at this point ^^'

> [1/1] ui: login: opt the tfa challenge handling into the new HttpOnly flow
>       commit: 4e7c0d6a264557e4e9eea3b0cae2a97260848469



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel