vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-27 06:21:18 -07:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

Security: constant time sha comparison for mcp token, DRY

Browse Source
This commit is contained in:
shamoon
2026-07-13 10:22:44 -07:00
parent 75822f632a
commit b7fb4405e4
4 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/utils/mcp/homepage-mcp.js
+10 -1
View File
@@ -1,4 +1,5 @@
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
import { createHash, timingSafeEqual } from "node:crypto";
import { join } from "path";
import yaml from "js-yaml";
@@ -61,6 +62,12 @@ function requiredToken() {
return process.env.HOMEPAGE_MCP_TOKEN;
}
function tokenMatches(provided, expectedDigest) {
if (typeof provided !== "string") return false;
const providedDigest = createHash("sha256").update(provided, "utf8").digest();
return timingSafeEqual(providedDigest, expectedDigest);
}
function jsonRpcResult(id, result) {
return { jsonrpc: "2.0", id, result };
}
@@ -440,7 +447,9 @@ export function mcpTokenAuthorized(req) {
if (!token) return false;
const authHeader = req.headers.authorization;
return authHeader === `Bearer ${token}` || req.headers["x-homepage-mcp-token"] === token;
const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice(7) : null;
const expectedDigest = createHash("sha256").update(token, "utf8").digest();
return tokenMatches(bearerToken, expectedDigest) || tokenMatches(req.headers["x-homepage-mcp-token"], expectedDigest);
}
export function handleMcpRequest(message) {
src/utils/mcp/homepage-mcp.test.js
+4
View File
@@ -626,5 +626,9 @@ describe("utils/mcp/homepage-mcp", () => {
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer secret" } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { "x-homepage-mcp-token": "secret" } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer wrong" } })).toBe(false);
process.env.HOMEPAGE_MCP_TOKEN = "é";
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer a" } })).toBe(false);
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer é" } })).toBe(true);
});
});