Hornwitser
dbe01c6c23
The jsonwebtoken accept strings as input for secrets which is nonsensical from a cryptographic standpoint as the algorithms all operate on byte sequences. Worse still, strings are encoded into bytes using UTF-8, which disallows certain sequences of bytes from appearing and potentially weakening the cryptography. For legacy reasons the master secret was encoded into base64 _and passed as a string to jsonwebtoken_. This further weakened the crypto as the bytes that can appear in base 64 is only 1/4 of the 256 possible values for bytes. This could significantly weaken the cryptographic strength of the tokens. I have known of this issue for quite some time but has put off actually fixing it for too long now. Since the master secret is already documented as being in base 64, decode it as base 64 and pass it as a byte Buffer to jsonwebtoken. This will ensure every byte value is possible in the byte sequence passed to the jsonwebtoken crypto. The impact of this change is unfortunately that all tokens will become invalid and will have to be reissued.
Clusterio Player Auth Plugin
Plugin authenticating logged in players to the web interface. Authentication is achieved by a simple challenge response mechanism where players have to log into one of the Factorio server in the cluster and open a dialog that presents a code, this code is input into the login form on the web interface which gives back a second code. Once the player enters the second code into the dialog in-game the web interface is authenticated.
Installation
Run the following commands in the folder Clusterio is installed to:
npm install @clusterio/plugin-player_auth
npx clusteriomaster plugin add @clusterio/plugin-player_auth
Substitute clusteriomaster with clusterioslave or clusterioctl if this a dedicate slave or ctl installation respectively.
Master Configuration
player_auth.code_length
Length in character of the generated challenge codes that need to be input between the web interface login form and the in-game Factorio login dialog.
Defaults to 6.
player_auth.code_timeout
Time in seconds the first code generated stays valid. The login must be completed in less than this time starting from when the login dialog is opened in-game.
Defaults to 120.