HTTPS & Authentication

Ceaser shift

• Math glues primary and public key
  
  
• Private key will ALWAYS be kept secret
  
  
• Public key can be seen by anyone

apt-get install openssl
brew install openssl
setup.exe ;)

# Create a directory for our certificate filesmkdir sslcd ssl/
# Generate a private keyopenssl genrsa -out nodettps.dev.fluoline.net.key 2048

• http://www.clickssl.com
• https://www.sslcertificaten.nl
  
• http://www.startssl.com 
  

// Require some modules...
var express     = require('express');
var http        = require('http');

// Create our express application
var app = express();

// Define some routes
app.get('/', function(req, res) {
    res.send("Welcome!");    
});

// Create a http for our app
var httpServer = http.createServer(app);

// Start listening
httpServer.listen(80);

basic_http.js

// Require some modules...
var express     = require('express');
var path        = require('path');
var fs          = require('fs');
var http        = require('http');
var https       = require('https');

// Store the certificate details for later use
var httpsOptions = {
                        key: fs.readFileSync('ssl/nodettps.dev.fluoline.net.key', 'utf8'), 
                        cert: fs.readFileSync('ssl/nodettps.dev.fluoline.net.crt', 'utf8'),
                    };
                    
// Create our express application
var app = express();

// Define some routes
app.get('/', function(req, res) {
    // Render
    res.send("welcome");
});

// Create a http and https server for our app
var httpServer = http.createServer(app);
var httpsServer = https.createServer(httpsOptions, app);

httpServer.listen(80);
httpsServer.listen(443);

basic_https.js

// Store the certificate details for later use
var httpsOptions = {
    key: fs.readFileSync('ssl/nodettps.dev.fluoline.net.key', 'utf8'), 
    cert: fs.readFileSync('ssl/nodettps.dev.fluoline.net.crt', 'utf8'),
    ca: [
        fs.readFileSync('ssl/geotrust_cross_root_ca.txt', 'utf8'), 
        fs.readFileSync('ssl/rapid_ssl_ca.txt', 'utf8')
        ]};

basic_https_with_intermediate_certificate.js

TLS Session resumption

var tlsSessions = require('strong-cluster-tls-store');
...
// Create a http and https server for our app
var httpServer = http.createServer(app);
var httpsServer = https.createServer(httpsOptions, app);

// Keep tlsSessions in memory
tlsSessions(httpsServer);

httpServer.listen(80);
httpsServer.listen(443);

basic_https_with_restore_session.js

// Create our express application
var app = express();

// Redirect all http traffic to https
app.use(function(req,res,next) {
   if (!/https/.test(req.protocol)){
        res.redirect("https://" + req.headers.host + req.url);
    } else {
        // If we're on https, ensure all requests will be over https
        // http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
        res.setHeader("Strict-Transport-Security", "max-age=31536000");
        return next();
    }
});

basic_https_with_http_redirect.js

 npm install passport

• 140+ authentication strategies
• Single sign-on with OpenID and OAuth
• ...

npm install passport
npm install passport-http 

// Require Passport and its BasicStrategy module
var passport        = require('passport');
var BasicStrategy   = require('passport-http').BasicStrategy;

https_with_passport_basic.js

// Create our express application and configure it
var app = express();
app.configure(function() {
    app.use(passport.initialize());
    app.use(app.router);
});

// Initiate Passport for http Basic authentication 
passport.use(new BasicStrategy(
    function(username, password, done) {
        if (username == "admin" && password == "demo") {
            return done(null, "admin");
        } else {
            return done(null, false);
        }
    }
));

https_with_passport_basic.js

// Define some routes
// Welcome page
app.get('/', function(req, res) {
    res.send("Welcome click here to login.");
});

// The protected login page
app.get('/login', 
  passport.authenticate('basic', { session: false }),
  function(req, res) {
    res.send("It is you, " + req.user + "!");
  });

https_with_passport_basic.js

npm install connect-roles

var user = require('connect-roles');
app.use(user);

user.use('access private page', function (req) {
    if (req.user.role ==== 'member') { return true; }
})

app.get('/private', user.can('access private page'), function (req, res) {
    res.render('private');
});

• A Belgian Identity card or kids-ID
• Belgian eID software:
  http://eid.belgium.be/

npm install client-certificate-auth

var httpsOptions = {
    key: fs.readFileSync('ssl/nodettps.dev.fluoline.net.key', 'utf8'), 
    cert: fs.readFileSync('ssl/nodettps.dev.fluoline.net.crt', 'utf8'),
    ca: [   fs.readFileSync('ssl/geotrust_cross_root_ca.txt', 'utf8'), 
            fs.readFileSync('ssl/rapid_ssl_ca.txt', 'utf8'),
            fs.readFileSync('ssl/citizen_ca.txt', 'utf8'),
            fs.readFileSync('ssl/belgium_root_ca.txt', 'utf8')
        ],
    ciphers: 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH',
    honorCipherOrder: true,
    requestCert: true,
    rejectUnauthorized: false
};

https_with_belgian_eid.js

var clientCertificateAuth = require('client-certificate-auth');

app.get('/', function(req, res) {
    res.send("Welcome click here to login with your Belgian eID.");
});

app.get('/eid', clientCertificateAuth(validateCertificate), function(req, res) {
    var clientCertificate    = req.connection.getPeerCertificate();
    var clientName           = clientCertificate.subject.SN;
    var clientNationalNumber = clientCertificate.subject.serialNumber;
    res.send("Welcome " + clientName + " (" + clientNationalNumber + ")!");
});

function validateCertificate(cert) {
    // if (cert.subject.serialNumber == in database) { return true; }
    return true;
}

https_with_belgian_eid.js