feat: Phising resistant MFA

.changeset/flat-poets-cheat.md

@@ -0,0 +1,28 @@
+---
+'@rocket.chat/web-ui-registration': minor
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/desktop-api': minor
+'@rocket.chat/models': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
+
+### What’s New
+
+- **Improved OAuth login security**  
+  OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
+
+- **Built-in CSRF, state validation, and PKCE protection**  
+  OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
+
+- **Improved two-step verification with OAuth logins**  
+  Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
+
+- **Improved mobile & desktop app login**  
+  Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.

apps/meteor/app/2fa/server/code/EmailCheck.ts

@@ -10,7 +10,7 @@ import * as Mailer from '../../../mailer/server/api';
 import { settings } from '../../../settings/server';
 
 export class EmailCheck implements ICodeCheck {
-	public readonly name = 'email';
+	public readonly name: string = 'email';
 
 	private getUserVerifiedEmails(user: IUser): string[] {
 		if (!Array.isArray(user.emails)) {
@@ -145,6 +145,6 @@ ${t('If_you_didnt_try_to_login_in_your_account_please_ignore_this_email')}
 
 	public async maxFaildedAttemtpsReached(user: IUser) {
 		const maxAttempts = settings.get<number>('Accounts_TwoFactorAuthentication_Max_Invalid_Email_Code_Attempts');
-		return (await Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts)) as boolean;
+		return Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts);
 	}
 }

apps/meteor/app/2fa/server/code/EmailCheckForOAuth.ts

@@ -0,0 +1,37 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+
+import { EmailCheck } from './EmailCheck';
+
+export class EmailCheckForOAuth extends EmailCheck {
+	public override readonly name = 'email-oauth';
+
+	public readonly method = 'email';
+
+	public async sendTwoFactorChallenge(user: IUser): Promise<string> {
+		const challengeId = await TwoFactorChallenges.createTwoFactorChallenge(user._id, 'email');
+		await this.sendEmailCode(user);
+		return challengeId;
+	}
+
+	public async verifyEmailTwoFactorChallenge(user: IUser, challengeId: string, code: string): Promise<boolean> {
+		const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+		if (!challenge) {
+			return false;
+		}
+
+		if (challenge.expireAt && challenge.expireAt < new Date()) {
+			throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+		}
+
+		const isCodeValid = await this.verify(user, code);
+
+		if (!isCodeValid) {
+			return false;
+		}
+
+		await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+
+		return true;
+	}
+}

apps/meteor/app/2fa/server/code/TOTPCheck.ts

@@ -5,7 +5,7 @@ import { settings } from '../../../settings/server';
 import { TOTP } from '../lib/totp';
 
 export class TOTPCheck implements ICodeCheck {
-	public readonly name = 'totp';
+	public readonly name: string = 'totp';
 
 	public isEnabled(user: IUser): boolean {
 		if (!settings.get('Accounts_TwoFactorAuthentication_By_TOTP_Enabled')) {

apps/meteor/app/2fa/server/code/TOTPCheckForOAuth.ts

@@ -0,0 +1,35 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+
+import { TOTPCheck } from './TOTPCheck';
+
+export class TOTPCheckForOAuth extends TOTPCheck {
+	public override readonly name = 'totp-oauth';
+
+	public readonly method = 'totp';
+
+	public async sendTwoFactorChallenge(user: IUser): Promise<string> {
+		return TwoFactorChallenges.createTwoFactorChallenge(user._id, 'totp');
+	}
+
+	public async verifyEmailTwoFactorChallenge(user: IUser, challengeId: string, code: string): Promise<boolean> {
+		const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+		if (!challenge) {
+			return false;
+		}
+
+		if (challenge.expireAt && challenge.expireAt < new Date()) {
+			throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+		}
+
+		const isCodeValid = await this.verify(user, code);
+
+		if (!isCodeValid) {
+			return false;
+		}
+
+		await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+
+		return true;
+	}
+}

apps/meteor/app/2fa/server/code/index.ts

@@ -63,8 +63,8 @@ function getFingerprintFromConnection(connection: IMethodConnection): string {
 	return crypto.createHash('md5').update(data).digest('hex');
 }
 
-function getRememberDate(from: Date = new Date()): Date | undefined {
-	const rememberFor = parseInt(settings.get('Accounts_TwoFactorAuthentication_RememberFor') as string, 10);
+export function getRememberDate(from: Date = new Date()): Date | undefined {
+	const rememberFor = settings.get<number>('Accounts_TwoFactorAuthentication_RememberFor');
 
 	if (rememberFor <= 0) {
 		return;
@@ -118,6 +118,20 @@ function isAuthorizedForToken(connection: IMethodConnection, user: IUser, option
 	return true;
 }
 
+export async function rememberAuthorizationByToken(token: string, userId: IUser['_id'], connection: IMethodConnection): Promise<void> {
+	const user = await Users.findOneByIdAndLoginHashedToken(userId, token, { projection: { _id: 1, services: 1 } });
+	if (!user) {
+		throw new Meteor.Error('error-user-not-found', 'user not found');
+	}
+
+	const expires = getRememberDate();
+	if (!expires) {
+		return;
+	}
+
+	await Users.setTwoFactorAuthorizationHashAndUntilForUserIdAndToken(user._id, token, getFingerprintFromConnection(connection), expires);
+}
+
 async function rememberAuthorization(connection: IMethodConnection, user: IUser): Promise<void> {
 	const currentToken = Accounts._getLoginToken(connection.id);
 
@@ -146,7 +160,7 @@ interface ICheckCodeForUser {
 	connection?: IMethodConnection;
 }
 
-const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
+export const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
 	// try first getting one of the available methods or the one that was already provided
 	const selectedMethod = getMethodByNameOrFirstActiveForUser(user, method);
 	if (selectedMethod) {
@@ -174,7 +188,6 @@ export async function checkCodeForUser({ user, code, method, options = {}, conne
 	}
 
 	let existingUser: IUser | null;
-
 	if (typeof user === 'string') {
 		existingUser = await getUserForCheck(user);
 	} else {

apps/meteor/app/api/server/ApiClass.ts

@@ -144,7 +144,7 @@ const rateLimiterDictionary: Record<
 	}
 > = {};
 
-const generateConnection = (
+export const generateConnection = (
 	ipAddress: string,
 	httpHeaders: Record<string, any>,
 ): {

apps/meteor/app/api/server/index.ts

@@ -45,7 +45,7 @@ import './v1/mailer';
 import './v1/teams';
 import './v1/moderation';
 import './v1/uploads';
-
+import './v1/twoFactorChallenges';
 // This has to come last so all endpoints are registered before generating the OpenAPI documentation
 import './default/openApi';
 

apps/meteor/app/api/server/v1/twoFactorChallenges.ts

@@ -0,0 +1,112 @@
+import type { IMethodConnection } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+import { isTwoFactorChallengesSendEmailCodeParamsPOST, isTwoFactorChallengesVerifyChallengeParamsPOST } from '@rocket.chat/rest-typings';
+import { Accounts } from 'meteor/accounts-base';
+
+import { emailCheckForOAuth, getTwoFAMethodForOAuth } from '../../../../server/lib/oauth/twoFactorAuth';
+import { getUserForCheck, rememberAuthorizationByToken } from '../../../2fa/server/code';
+import { generateConnection } from '../ApiClass';
+import { API } from '../api';
+
+API.v1.addRoute(
+	'twoFactorChallenges.sendEmailCode',
+	{ validateParams: isTwoFactorChallengesSendEmailCodeParamsPOST, rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 5 } },
+	{
+		async post() {
+			const { challengeId } = this.bodyParams;
+
+			if (!challengeId) {
+				throw new Meteor.Error('error-parameter-required', 'challengeId is required');
+			}
+
+			const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+
+			if (!challenge) {
+				throw new Meteor.Error('error-challenge-not-found', 'challenge not found');
+			}
+
+			if (challenge.expireAt && challenge.expireAt < new Date()) {
+				throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+			}
+
+			if (challenge.method !== 'email') {
+				throw new Meteor.Error('error-invalid-challenge-method', 'invalid challenge method');
+			}
+
+			const { userId } = challenge;
+
+			const user = await getUserForCheck(userId);
+
+			if (!user) {
+				throw new Meteor.Error('error-user-not-found', 'user not found');
+			}
+
+			await emailCheckForOAuth.sendEmailCode(user);
+
+			return API.v1.success();
+		},
+	},
+);
+
+API.v1.addRoute(
+	'twoFactorChallenges.verifyChallenge',
+	{
+		validateParams: isTwoFactorChallengesVerifyChallengeParamsPOST,
+		rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 5 },
+	},
+	{
+		async post() {
+			const { challengeId, code } = this.bodyParams;
+
+			if (!challengeId || !code) {
+				throw new Meteor.Error('error-parameter-required', 'challengeId and code are required');
+			}
+
+			const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+
+			if (!challenge) {
+				throw new Meteor.Error('error-challenge-not-found', 'challenge not found');
+			}
+
+			const { userId } = challenge;
+
+			const user = await getUserForCheck(userId);
+
+			if (!user) {
+				throw new Meteor.Error('error-user-not-found', 'user not found');
+			}
+
+			const twoFAMethod = getTwoFAMethodForOAuth(challenge.method);
+
+			const isCodeValid = await twoFAMethod.verifyEmailTwoFactorChallenge(user, challengeId, code);
+
+			if (!isCodeValid) {
+				const tooManyAttempts = await twoFAMethod.maxFaildedAttemtpsReached(user);
+				if (tooManyAttempts) {
+					await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+					throw new Meteor.Error('totp-max-attempts', 'TOTP Maximun Failed Attempts Reached');
+				}
+				return API.v1.failure('error-invalid-code', 'Invalid code');
+			}
+
+			const stampedToken = Accounts._generateStampedLoginToken();
+
+			await Accounts._insertLoginToken(user._id, stampedToken);
+
+			const hashedToken = Accounts._hashLoginToken(stampedToken.token);
+
+			const connection = {
+				...generateConnection(this.requestIp, this.request.headers),
+				token: hashedToken,
+			} as unknown as IMethodConnection;
+
+			// remember the 2FA authorization for the next requests
+			await rememberAuthorizationByToken(hashedToken, user._id, connection);
+
+			return API.v1.success({
+				loginToken: stampedToken.token,
+				userId: user._id,
+			});
+		},
+	},
+);

apps/meteor/app/apple/lib/handleIdentityToken.ts

@@ -27,7 +27,7 @@ async function isValidAppleJWT(identityToken: string, header: any): Promise<bool
 	}
 }
 
-export async function handleIdentityToken(identityToken: string): Promise<{ id: string; email: string; name: string }> {
+export async function handleIdentityToken(identityToken: string): Promise<Record<string, any>> {
 	const decodedToken = KJUR.jws.JWS.parse(identityToken);
 
 	if (!(await isValidAppleJWT(identityToken, decodedToken.headerObj))) {
@@ -38,15 +38,14 @@ export async function handleIdentityToken(identityToken: string): Promise<{ id:
 		throw new Error('identityToken does not have a payload');
 	}
 
-	const { iss, sub, email } = decodedToken.payloadObj as any;
+	const { iss, sub } = decodedToken.payloadObj as any;
 	if (!iss) {
 		throw new Error('Insufficient data in auth response token');
 	}
 
 	const serviceData = {
 		id: sub,
-		email,
-		name: '',
+		...decodedToken.payloadObj,
 	};
 
 	return serviceData;