h1or4dme8/osu-lazer
1
0
Fork 0
mirror of https://github.com/ppy/osu.git synced 2024-12-14 11:35:35 +08:00
Code Issues Releases Wiki Activity

Send client-generated session GUID for identification purposes

Browse Source 
This is the first half of a change that *may* fix
https://github.com/ppy/osu/issues/26338 (it definitely fixes *one case*
where the issue happens, but I'm not sure if it will cover all of them).

As described in the issue thread, using the `jti` claim from the JWT
used for authorisation seemed like a decent idea. However, upon closer
inspection the scheme falls over badly in a specific scenario where:

1. A client instance connects to spectator server using JWT A.

2. At some point, JWT A expires, and is silently rotated by the game in
   exchange for JWT B.

   The spectator server knows nothing of this, and continues to only
   track JWT A, including the old `jti` claim in said JWT.

3. At some later point, the client's connection to one of the spectator
   server hubs drops out. A reconnection is automatically attempted,
   *but* it is attempted using JWT B.

   The spectator server was not aware of JWT B until now, and said JWT
   has a different `jti` claim than the old one, so to the spectator
   server, it looks like a completely different client connecting, which
   boots the user out of their account.

This PR adds a per-session GUID which is sent in a HTTP header on every
connection attempt to spectator server. This GUID will be used instead
of the `jti` claim in JWTs as a persistent identifier of a single user's
single lazer session, which bypasses the failure scenario described
above.

I don't think any stronger primitive than this is required. As far as I
can tell this is as strong a protection as the JWT was (which is to say,
not *very* strong), and doing this removes a lot of weird complexity
that would be otherwise incurred by attempting to have client ferry all
of its newly issued JWTs to the server so that it can be aware of them.
This commit is contained in:
Bartłomiej Dach 2024-07-17 14:11:35 +02:00
parent 5633297d1c
commit 3006bae0d8
No known key found for this signature in database
4 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
osu.Game/Online/API/APIAccess.cs
View File

@ -164,6 +164,8 @@ namespace osu.Game.Online.API
public string AccessToken => authentication.RequestAccessToken();
public Guid SessionIdentifier { get; } = Guid.NewGuid();
/// <summary>
/// Number of consecutive requests which failed due to network issues.
/// </summary>

2
osu.Game/Online/API/DummyAPIAccess.cs
View File

@ -39,6 +39,8 @@ namespace osu.Game.Online.API
public string AccessToken => "token";
public Guid SessionIdentifier { get; } = Guid.NewGuid();
/// <seealso cref="APIAccess.IsLoggedIn"/>
public bool IsLoggedIn => State.Value > APIState.Offline;

6
osu.Game/Online/API/IAPIProvider.cs
View File

@ -44,6 +44,12 @@ namespace osu.Game.Online.API
/// </summary>
string AccessToken { get; }
/// <summary>
/// Used as an identifier of a single local lazer session.
/// Sent across the wire for the purposes of concurrency control to spectator server.
/// </summary>
Guid SessionIdentifier { get; }
/// <summary>
/// Returns whether the local user is logged in.
/// </summary>

8
osu.Game/Online/HubClientConnector.cs
View File

@ -19,6 +19,9 @@ namespace osu.Game.Online
{
public const string SERVER_SHUTDOWN_MESSAGE = "Server is shutting down.";
public const string VERSION_HASH_HEADER = @"OsuVersionHash";
public const string CLIENT_SESSION_ID_HEADER = @"X-Client-Session-ID";
/// <summary>
/// Invoked whenever a new hub connection is built, to configure it before it's started.
/// </summary>
@ -68,8 +71,9 @@ namespace osu.Game.Online
options.Proxy.Credentials = CredentialCache.DefaultCredentials;
}
options.Headers.Add("Authorization", $"Bearer {API.AccessToken}");
options.Headers.Add("OsuVersionHash", versionHash);
options.Headers.Add(@"Authorization", @$"Bearer {API.AccessToken}");
options.Headers.Add(VERSION_HASH_HEADER, versionHash);
options.Headers.Add(CLIENT_SESSION_ID_HEADER, API.SessionIdentifier.ToString());
});
if (RuntimeFeature.IsDynamicCodeCompiled && preferMessagePack)