MAPG-142 redefine tokens and increase OAuth security with nonce

src/Controller/LoginController.php

@@ -53,13 +53,16 @@ class LoginController
     public function getGoogleLoginRedirect(): IRedirect
     {
         $state = bin2hex(random_bytes(16));
+        $nonce = bin2hex(random_bytes(16));
 
         $this->request->session()->set('oauth_state', $state);
+        $this->request->session()->set('oauth_nonce', $nonce);
 
         $oAuth = new GoogleOAuth(new Request());
         $url = $oAuth->getDialogUrl(
             $state,
-            $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('login-google-action')->generateLink()
+            $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('login-google-action')->generateLink(),
+            $nonce
         );
 
         return new Redirect($url, IRedirect::TEMPORARY);
@@ -214,16 +217,20 @@ class LoginController
         }
 
         $jwtParser = new JwtParser($tokenData['id_token']);
-        $userData = $jwtParser->getPayload();
+        $idToken = $jwtParser->getPayload();
 
-        if (!$userData['email_verified']) {
+        if ($idToken['nonce'] !== $this->request->session()->get('oauth_nonce')) {
             return new HtmlContent('login/google_login');
         }
 
-        $user = $this->userRepository->getByGoogleSub($userData['sub']);
+        if (!$idToken['email_verified']) {
+            return new HtmlContent('login/google_login');
+        }
+
+        $user = $this->userRepository->getByGoogleSub($idToken['sub']);
 
         if ($user === null) {
-            $this->request->session()->set('google_user_data', $userData);
+            $this->request->session()->set('google_user_data', ['sub' => $idToken['sub'], 'email' => $idToken['email']]);
 
             return new Redirect(\Container::$routeCollection->getRoute('signup-google')->generateLink(), IRedirect::TEMPORARY);
         }

src/Controller/UserController.php

@@ -59,14 +59,17 @@ class UserController implements ISecured
         $user = $this->request->user();
 
         $state = bin2hex(random_bytes(16));
+        $nonce = bin2hex(random_bytes(16));
 
         $this->request->session()->set('oauth_state', $state);
+        $this->request->session()->set('oauth_nonce', $nonce);
 
         $oAuth = new GoogleOAuth(new Request());
 
         $url = $oAuth->getDialogUrl(
             $state,
             $this->request->getBase() . '/' . \Container::$routeCollection->getRoute('account.googleAuthenticate-action')->generateLink(),
+            $nonce,
             $user->getEmail()
         );
 
@@ -95,9 +98,13 @@ class UserController implements ISecured
         }
 
         $jwtParser = new JwtParser($tokenData['id_token']);
-        $userData = $jwtParser->getPayload();
+        $idToken = $jwtParser->getPayload();
 
-        if ($userData['sub'] !== $user->getGoogleSub()) {
+        if ($idToken['nonce'] !== $this->request->session()->get('oauth_nonce')) {
+            return new HtmlContent('account/google_authenticate', ['success' => false]);
+        }
+
+        if ($idToken['sub'] !== $user->getGoogleSub()) {
             return new HtmlContent('account/google_authenticate', [
                 'success' => false,
                 'errorText' => 'This Google account is not linked to your account.'