Add support for generating TOTP cookies

This allows other sites in the openstreetmap.org domain to validate
that requests are coming from a www.openstreetmap.org user.

diff --git a/Gemfile b/Gemfile
index ef93f0d8ff0960b072d87945805c46c87daecee1..5e6eebfc90006497f2062864a47b754fd53300df 100644 (file)
--- a/Gemfile
+++ b/Gemfile
@@ -85,6 +85,9 @@ gem "faraday"
 # Load geoip for querying Maxmind GeoIP database
 gem "geoip"
 
 # Load geoip for querying Maxmind GeoIP database
 gem "geoip"
 

+# Load rotp to generate TOTP tokens
+gem "rotp"
+

 # Load memcache client in case we are using it
 gem "dalli"
 gem "kgio"
 # Load memcache client in case we are using it
 gem "dalli"
 gem "kgio"

diff --git a/Gemfile.lock b/Gemfile.lock
index 1e0e7a8706ba9e04f7448761bb0bdfc84ec9b1dd..5ca69babea8f0b070a381c027e0df42597e550a9 100644 (file)
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -264,6 +264,7 @@ GEM
     ref (2.0.0)
     request_store (1.3.1)
     rinku (2.0.2)
     ref (2.0.0)
     request_store (1.3.1)
     rinku (2.0.2)

+    rotp (3.3.0)

     rubocop (0.46.0)
       parser (>= 2.3.1.1, < 3.0)
       powerpack (~> 0.1)
     rubocop (0.46.0)
       parser (>= 2.3.1.1, < 3.0)
       powerpack (~> 0.1)


@@ -373,6 +374,7 @@ DEPENDENCIES
   rails-i18n (~> 4.0.0)
   redcarpet
   rinku (>= 1.2.2)
   rails-i18n (~> 4.0.0)
   redcarpet
   rinku (>= 1.2.2)

+  rotp

   rubocop
   sanitize
   sass-rails (~> 5.0)
   rubocop
   sanitize
   sass-rails (~> 5.0)

diff --git a/app/controllers/site_controller.rb b/app/controllers/site_controller.rb
index 1a4c9f148425eef9621568d8d822fd0a49a1a916..b10de379830c6c5a751d1c957ac88a51ff9d4282 100644 (file)
--- a/app/controllers/site_controller.rb
+++ b/app/controllers/site_controller.rb
@@ -13,6 +13,14 @@ class SiteController < ApplicationController
     unless STATUS == :database_readonly || STATUS == :database_offline
       session[:location] ||= OSM.ip_location(request.env["REMOTE_ADDR"])
     end
     unless STATUS == :database_readonly || STATUS == :database_offline
       session[:location] ||= OSM.ip_location(request.env["REMOTE_ADDR"])
     end

+
+    if defined?(TOTP_KEY)
+      cookies["_osm_totp_token"] = {
+        :value => ROTP::TOTP.new(TOTP_KEY, :interval => 3600).now,
+        :domain => ".openstreetmap.org",
+        :expires => 1.day.from_now
+      }
+    end

   end
 
   def permalink
   end
 
   def permalink

diff --git a/config/example.application.yml b/config/example.application.yml
index fd388ad88221dd202570366c14aa6cb207ccff8b..6319be709e5e72a7723273f2b77d005857ae6129 100644 (file)
--- a/config/example.application.yml
+++ b/config/example.application.yml
@@ -115,6 +115,8 @@ defaults: &defaults
   #mapzen_valhalla_key: ""
   # Thunderforest authentication details
   #thunderforest_key: ""
   #mapzen_valhalla_key: ""
   # Thunderforest authentication details
   #thunderforest_key: ""

+  # Key for generating TOTP tokens
+  #totp_key: ""

 
 development:
   <<: *defaults
 
 development:
   <<: *defaults