Enhance token generation: include expiration in cookie token and improve authentication checks

api/api.php

@@ -36,12 +36,14 @@ class gbAPI {
         // Generate Token
         $payload = [
             "user" => $username,
-            "auth" => true
+            "auth" => true,
+            "exp" => $config["COOKIE_TOKEN_LIFETIME"]
         ];
-        $string = json_encode($payload);
+        $string = base64_encode(json_encode($payload));
         $secret = $config["COOKIE_TOKEN_SIGNATURE"];
 
-        return hash_hmac("sha256", $string, $secret);
+        $sig = hash_hmac("sha256", $string, $secret);
+        return base64_encode(json_encode($payload)) . "." . $sig;
     }
 
     function generateAPIToken($username) {
@@ -52,10 +54,11 @@ class gbAPI {
             "user" => $username,
             "auth" => true
         ];
-        $string = json_encode($payload);
+        $string = base64_encode(json_encode($payload));
         $secret = $config["API_TOKEN_SIGNATURE"];
 
-        return hash_hmac("sha256", $string, $secret);
+        $sig = hash_hmac("sha256", $string, $secret);
+        return base
     }
 
     function checkAuth() {
@@ -69,7 +72,14 @@ class gbAPI {
 
             $result = hash_equals($expected, $given);
             if ($result) {
+                $given_string = explode(".", $given);
+                $body = json_decode(base64_decode($given_string[0]));
+
+                if ($body["exp"] > time()) {
                     return true;
+                }else{
+                    return false;
+                }
             }
         }elseif (isset($_SERVER["HTTP_X_API_KEY"])) {
             // Decode Token
@@ -88,14 +98,28 @@ class gbAPI {
         return false;
     }
 
-    function answer($status, $data = []) {
+    function answer($status, $data = [], $error = false) {
         http_response_code($status);
-        Header ("Content-Type: application/json; charset=UTF-8");
+        header("Content-Type: application/json; charset=UTF-8");
 
-        $data = json_encode($data);
 
-        $json = '{"status":' . $status . ',"data":' . $data . '}';
+        if ($error) {
-        die($json);
+            $json = [];
+
+            $json["status"] = $status;
+
+            foreach ($data as $key => $value) {
+                $json[$key] = $value;
+            }
+        }else{
+            $json = [
+                "status" => $status,
+                "data" => $data
+            ];
+        }
+
+        $return = json_encode($json);
+        die($return);
     }
 
     function dbCommand($command, $expectResult, $stmtArgsRequired = false, $stmtArgs = []) {
@@ -106,6 +130,13 @@ class gbAPI {
             $db_name = $config["DB_FILE"];
             $db_path = APP_PATH . $db_name;
 
+            if (!is_file($db_path)) {
+                $api->answer(500, [
+                    "error" => "database_not_found",
+                    "error_display" => "The Database was not found."
+                ], true);
+            }
+
             $db = new PDO("sqlite:" . $db_path);
             $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
         }

api/auth/login.php

@@ -9,42 +9,43 @@ if ($_SERVER["REQUEST_METHOD"] !== "POST") {
     $api->answer(400, [
         "error" => "false_request_method",
         "error_text" => "Only POST allowed"
-    ]);
+    ], true);
 }
 
-if (!isset($_POST["username"]) || !isset($_POST["password"])) {
+$input = json_decode(file_get_contents("php://input"), true);
+
+if (!isset($input["username"]) || !isset($input["password"])) {
     $api->answer(400, [
         "error" => "missing_fields",
         "error_text" => "Some fields are missing"
-    ]);
+    ], true);
 }
 
-$username = $_POST["username"];
+$username = $input["username"];
-$password = $_POST["password"];
+$password = $input["password"];
 
 // Prepare SQL Command
-$hash = password_hash($password, PASSWORD_DEFAULT);
+$command = "SELECT username, password FROM users WHERE username = :username";
-
-$command = "SELECT username, password FROM users WHERE username = :username AND password = :password";
 $args = [
-    ":username" => $username,
+    ":username" => $username
-    ":password" => $hash
 ];
 
 // Execute SQL Command
 $result = $api->dbCommand($command, true, true, $args);
 
 // Check Result
-if ($result && password_verify($password, $result["password"])) {
+if ($result && password_verify($password, $result[0]["password"])) {
     // Login successful. Generate Auth Token
     $token = $api->generateCookieToken($username);
 
     // Set cookies
     setcookie("auth_token", $token, time() + 86400, "/");
     setcookie("username", $username, time() + 86400, "/");
+
+    $api->answer(200);
 }else{
     $api->answer(401, [
         "error" => "unauthorized",
         "error_text" => "A user with this password does not exists."
-    ]);
+    ], true);
 }

public/test.php

@@ -15,4 +15,6 @@
 
 //print_r(PDO::getAvailableDrivers());
 
-print_r(json_decode('{"entrys":[{"name":"marc"}]}', true));
+//print_r(json_decode('{"entrys":[{"name":"marc"}]}', true));
+
+print_r(explode(".", "jakob.stinkt"));