user
3 weeks ago
4 changed files with 411 additions and 1 deletions
@ -0,0 +1,152 @@ |
|||||
|
package files |
||||
|
|
||||
|
import ( |
||||
|
"crypto/rand" |
||||
|
"encoding/hex" |
||||
|
"encoding/json" |
||||
|
"errors" |
||||
|
"fmt" |
||||
|
"math/big" |
||||
|
"net/http" |
||||
|
"strconv" |
||||
|
"sync" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/golang-jwt/jwt/v5" |
||||
|
) |
||||
|
|
||||
|
const captchaTTL = 10 * time.Minute |
||||
|
|
||||
|
type captchaClaims struct { |
||||
|
Expected int `json:"ans"` |
||||
|
jwt.RegisteredClaims |
||||
|
} |
||||
|
|
||||
|
// jtiStore tracks used token IDs to make each captcha token single-use.
|
||||
|
type jtiStore struct { |
||||
|
mu sync.Mutex |
||||
|
used map[string]time.Time // jti → token expiry
|
||||
|
} |
||||
|
|
||||
|
var usedJTIs = &jtiStore{used: make(map[string]time.Time)} |
||||
|
|
||||
|
func init() { |
||||
|
// Periodically remove expired JTIs so the map doesn't grow forever.
|
||||
|
go func() { |
||||
|
ticker := time.NewTicker(captchaTTL) |
||||
|
defer ticker.Stop() |
||||
|
for range ticker.C { |
||||
|
usedJTIs.mu.Lock() |
||||
|
now := time.Now() |
||||
|
for jti, exp := range usedJTIs.used { |
||||
|
if now.After(exp) { |
||||
|
delete(usedJTIs.used, jti) |
||||
|
} |
||||
|
} |
||||
|
usedJTIs.mu.Unlock() |
||||
|
} |
||||
|
}() |
||||
|
} |
||||
|
|
||||
|
// claim marks a JTI as used. Returns false if it was already used.
|
||||
|
func (s *jtiStore) claim(jti string, exp time.Time) bool { |
||||
|
s.mu.Lock() |
||||
|
defer s.mu.Unlock() |
||||
|
if _, exists := s.used[jti]; exists { |
||||
|
return false |
||||
|
} |
||||
|
s.used[jti] = exp |
||||
|
return true |
||||
|
} |
||||
|
|
||||
|
func randInt(min, max int) int { |
||||
|
n, _ := rand.Int(rand.Reader, big.NewInt(int64(max-min+1))) |
||||
|
return int(n.Int64()) + min |
||||
|
} |
||||
|
|
||||
|
func randJTI() string { |
||||
|
b := make([]byte, 16) |
||||
|
rand.Read(b) //nolint:errcheck
|
||||
|
return hex.EncodeToString(b) |
||||
|
} |
||||
|
|
||||
|
// CaptchaHandler generates a math question and returns it with a signed token
|
||||
|
// that embeds the expected answer. The token is single-use and expires in 10 minutes.
|
||||
|
func CaptchaHandler(jwtSecret string) http.HandlerFunc { |
||||
|
type response struct { |
||||
|
Question string `json:"question"` |
||||
|
Token string `json:"token"` |
||||
|
} |
||||
|
|
||||
|
return func(w http.ResponseWriter, r *http.Request) { |
||||
|
ops := []string{"+", "-", "×"} |
||||
|
op := ops[randInt(0, 2)] |
||||
|
|
||||
|
var a, b, expected int |
||||
|
switch op { |
||||
|
case "+": |
||||
|
a, b = randInt(2, 20), randInt(1, 15) |
||||
|
expected = a + b |
||||
|
case "-": |
||||
|
a, b = randInt(5, 20), randInt(1, 10) |
||||
|
expected = a - b |
||||
|
case "×": |
||||
|
a, b = randInt(1, 10), randInt(1, 10) |
||||
|
expected = a * b |
||||
|
} |
||||
|
|
||||
|
exp := time.Now().Add(captchaTTL) |
||||
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, captchaClaims{ |
||||
|
Expected: expected, |
||||
|
RegisteredClaims: jwt.RegisteredClaims{ |
||||
|
ID: randJTI(), |
||||
|
ExpiresAt: jwt.NewNumericDate(exp), |
||||
|
}, |
||||
|
}) |
||||
|
signed, err := token.SignedString([]byte(jwtSecret)) |
||||
|
if err != nil { |
||||
|
http.Error(w, "internal error", http.StatusInternalServerError) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
w.Header().Set("Content-Type", "application/json") |
||||
|
json.NewEncoder(w).Encode(response{ //nolint:errcheck
|
||||
|
Question: fmt.Sprintf("%d %s %d", a, op, b), |
||||
|
Token: signed, |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// verifyCaptcha validates the signed token and checks that answerStr matches
|
||||
|
// the embedded expected answer. Each token can only be used once.
|
||||
|
func verifyCaptcha(tokenStr, answerStr, jwtSecret string) error { |
||||
|
answer, err := strconv.Atoi(answerStr) |
||||
|
if err != nil { |
||||
|
return errors.New("invalid answer") |
||||
|
} |
||||
|
|
||||
|
parsed, err := jwt.ParseWithClaims(tokenStr, &captchaClaims{}, func(t *jwt.Token) (any, error) { |
||||
|
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok { |
||||
|
return nil, errors.New("unexpected signing method") |
||||
|
} |
||||
|
return []byte(jwtSecret), nil |
||||
|
}) |
||||
|
if err != nil || !parsed.Valid { |
||||
|
return errors.New("invalid or expired token") |
||||
|
} |
||||
|
|
||||
|
claims, ok := parsed.Claims.(*captchaClaims) |
||||
|
if !ok || claims.ID == "" { |
||||
|
return errors.New("malformed token") |
||||
|
} |
||||
|
|
||||
|
if claims.Expected != answer { |
||||
|
return errors.New("wrong answer") |
||||
|
} |
||||
|
|
||||
|
if !usedJTIs.claim(claims.ID, claims.ExpiresAt.Time) { |
||||
|
return errors.New("token already used") |
||||
|
} |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
Loading…
Reference in new issue