Security Hardening

// CSRF.swift
import Vapor

/// Session-bound CSRF protection for browser forms (synchroniser token pattern).
///
/// Safe methods pass. Every other method must (1) come from an allowed origin and
/// (2) carry the token that is stored in the session, in the `X-CSRF-Token` header or the `_csrf` form field.
struct CSRFMiddleware: AsyncMiddleware {
    static let sessionKey = "csrf-token"
    static let headerName = "X-CSRF-Token"
    static let fieldName = "_csrf"

    /// Origins that may submit state-changing requests, for example `https://bookshelf.example.com`.
    let allowedOrigins: Set<String>

    func respond(to req: Request, chainingTo next: any AsyncResponder) async throws -> Response {
        // Mint the token on the first request of the session so that forms can embed it.
        let token = req.csrfToken

        switch req.method {
        case .GET, .HEAD, .OPTIONS:
            return try await next.respond(to: req)
        default:
            break
        }

        guard OriginPolicy(allowedOrigins: allowedOrigins).allows(req) else {
            throw Abort(.forbidden, reason: "Cross-origin request rejected.")
        }
        let submitted: String?
        if let header = req.headers.first(name: Self.headerName) {
            submitted = header                                   // fetch() and XMLHttpRequest clients
        } else if req.headers.contentType == .urlEncodedForm {
            // Middleware runs before the route collects the body, so collect it here (within the default limit).
            _ = try await req.body.collect(max: req.application.routes.defaultMaxBodySize.value).get()
            submitted = try? req.content.get(String.self, at: Self.fieldName)
        } else {
            submitted = nil
        }
        guard let submitted, constantTimeEqual(submitted, token) else {
            throw Abort(.forbidden, reason: "Missing or invalid CSRF token.")
        }
        return try await next.respond(to: req)
    }
}

extension Request {
    /// The CSRF token of this session. Reading it creates the session (and the token) when needed.
    var csrfToken: String {
        if let existing = session.data[CSRFMiddleware.sessionKey] { return existing }
        let token = Data([UInt8].random(count: 32)).base64EncodedString()
            .replacingOccurrences(of: "+", with: "-")
            .replacingOccurrences(of: "/", with: "_")
            .replacingOccurrences(of: "=", with: "")
        session.data[CSRFMiddleware.sessionKey] = token
        return token
    }
}

/// Compares two strings without returning early at the first difference.
func constantTimeEqual(_ a: String, _ b: String) -> Bool {
    let x = Array(a.utf8), y = Array(b.utf8)
    guard x.count == y.count else { return false }
    var difference: UInt8 = 0
    for (l, r) in zip(x, y) { difference |= l ^ r }
    return difference == 0
}

/// Fetch Metadata and `Origin` checks, the second layer of CSRF defence.
struct OriginPolicy: Sendable {
    let allowedOrigins: Set<String>

    func allows(_ req: Request) -> Bool {
        // Modern browsers say how the request relates to the site.
        if let site = req.headers.first(name: "Sec-Fetch-Site") {
            return site == "same-origin" || site == "none"
        }
        // Older browsers and non-browser clients: fall back to Origin.
        if let origin = req.headers.first(name: .origin) {
            return allowedOrigins.contains(origin)
        }
        // Neither header: not a browser cross-site request (curl, a native app). The token still applies.
        return true
    }
}

// HardenedRoutes.swift
import Fluent
import Vapor

struct LoginForm: Content {
    var email: String
    var password: String
}

struct TagForm: Content {
    var name: String
}

struct CoverReceipt: Content {
    var kind: String
    var bytes: Int
    var storedAs: String
}

func routes(_ app: Application, settings: SecuritySettings, limiter: @escaping @Sendable (Request) -> any RateLimiter) throws {
    // Public JSON API: no cookies, no CSRF token needed, read only.
    app.get("api", "tags") { req async throws -> [String] in
        try await Tag.query(on: req.db).sort(\.$name).all().map(\.name)
    }

    // Browser area: session, then the CSRF check, behind it everything that changes state.
    let web = app.grouped(app.sessions.middleware, CSRFMiddleware(allowedOrigins: settings.allowedOrigins))

    web.get("login") { req async throws -> Response in
        let html = """
        <!doctype html><title>Sign in</title>
        <form method="post" action="/login">
          <input type="hidden" name="_csrf" value="\(req.csrfToken)">
          <input name="email" type="email" required>
          <input name="password" type="password" required>
          <button>Sign in</button>
        </form>
        """
        return Response(status: .ok, headers: ["Content-Type": "text/html; charset=utf-8"], body: .init(string: html))
    }

    // Login is the brute-force target: five attempts per minute and client, counted before the session or the
    // CSRF check run, so a flood of forged requests is limited too.
    let loginLimit = RateLimitMiddleware(
        name: "login", limit: 5, window: .seconds(60),
        trustForwardedFor: settings.behindProxy, failOpen: false, limiter: limiter
    )
    let loginRoutes = app.grouped(loginLimit, app.sessions.middleware, CSRFMiddleware(allowedOrigins: settings.allowedOrigins))
    loginRoutes.post("login") { req async throws -> HTTPStatus in
        let form = try req.content.decode(LoginForm.self)
        let user = try await User.query(on: req.db).filter(\.$email == form.email.lowercased()).first()
        // An unknown email must cost as much as a wrong password: otherwise response times reveal which emails exist.
        var verified = false
        if let user {
            verified = (try? await req.password.async.verify(form.password, created: user.passwordHash)) ?? false
        } else {
            _ = try? await req.password.async.hash(form.password)
        }
        guard verified, let user, let id = user.id else {
            throw Abort(.unauthorized, reason: "Invalid email or password.")   // one message for both causes
        }
        req.session.data["user"] = id.uuidString
        req.session.data[CSRFMiddleware.sessionKey] = nil                      // new token after login
        return .noContent
    }

    // A state-changing form post: protected by CSRFMiddleware, limited to the default 64 kB body.
    web.post("tags") { req async throws -> Response in
        guard req.session.data["user"] != nil else { throw Abort(.unauthorized) }
        let form = try req.content.decode(TagForm.self)
        let name = form.name.trimmingCharacters(in: .whitespacesAndNewlines)
        guard (1...40).contains(name.count) else { throw Abort(.unprocessableEntity, reason: "Tag name must be 1 to 40 characters.") }
        let tag = Tag(name: name)
        try await tag.save(on: req.db)
        return Response(status: .created)
    }

    // An upload: a bigger body on this route only, and validated by signature, not by name or Content-Type.
    web.on(.POST, "covers", body: .collect(maxSize: "1mb")) { req async throws -> CoverReceipt in
        guard req.session.data["user"] != nil else { throw Abort(.unauthorized) }
        guard let body = req.body.data, body.readableBytes > 0 else { throw Abort(.badRequest, reason: "Empty upload.") }
        let kind: String
        let bytes = Array(body.readableBytesView.prefix(8))
        if bytes.starts(with: [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]) { kind = "png" }
        else if bytes.starts(with: [0xFF, 0xD8, 0xFF]) { kind = "jpg" }
        else { throw Abort(.unsupportedMediaType, reason: "Only PNG and JPEG covers are accepted.") }
        return CoverReceipt(kind: kind, bytes: body.readableBytes, storedAs: "\(UUID().uuidString).\(kind)")  // the server picks the name
    }
}

$ curl -si -c jar.txt localhost:8097/login | head -5
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
content-length: 294
set-cookie: bookshelf-session=j4KDg2GBP+...; Max-Age=28800; Path=/; HttpOnly; SameSite=Lax

$ curl -si -b jar.txt -d 'email=reader@example.com&password=change-me' localhost:8097/login
HTTP/1.1 403 Forbidden
{"reason":"Missing or invalid CSRF token.","error":true}

$ curl -si -b jar.txt -H 'Origin: https://evil.example' --data-urlencode "_csrf=$TOKEN" -d 'email=reader@example.com&password=change-me' localhost:8097/login
HTTP/1.1 403 Forbidden

$ curl -si -b jar.txt -c jar.txt --data-urlencode "_csrf=$TOKEN" -d 'email=reader@example.com&password=change-me' localhost:8097/login
HTTP/1.1 204 No Content

// SecurityHeaders.swift
import Vapor
import VaporSecurityHeaders

/// A hand-written security-headers middleware: fewer moving parts than a package, and easy to test.
struct SecurityHeadersMiddleware: AsyncMiddleware {
    struct Policy: Sendable {
        var contentSecurityPolicy = "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
        var strictTransportSecurity: String? = nil
        var referrerPolicy = "strict-origin-when-cross-origin"
        var permissionsPolicy = "camera=(), microphone=(), geolocation=()"
    }

    let policy: Policy

    func respond(to req: Request, chainingTo next: any AsyncResponder) async throws -> Response {
        let res = try await next.respond(to: req)
        res.headers.replaceOrAdd(name: .contentSecurityPolicy, value: policy.contentSecurityPolicy)
        res.headers.replaceOrAdd(name: "X-Content-Type-Options", value: "nosniff")
        res.headers.replaceOrAdd(name: "Referrer-Policy", value: policy.referrerPolicy)
        res.headers.replaceOrAdd(name: "Permissions-Policy", value: policy.permissionsPolicy)
        if let hsts = policy.strictTransportSecurity {
            res.headers.replaceOrAdd(name: .strictTransportSecurity, value: hsts)
        }
        return res
    }
}

/// The same result with VaporSecurityHeaders 4.2.0.
func makePackageSecurityHeaders(production: Bool) -> SecurityHeaders {
    let csp = ContentSecurityPolicy()
        .defaultSrc(sources: CSPKeywords.`self`)
        .frameAncestors(sources: CSPKeywords.none)
        .baseUri(sources: CSPKeywords.`self`)
        .formAction(sources: CSPKeywords.`self`)

    let factory = SecurityHeadersFactory()
        .with(contentSecurityPolicy: ContentSecurityPolicyConfiguration(value: csp))
        .with(contentTypeOptions: .init(option: .nosniff))
        .with(frameOptions: .init(option: .deny))
        .with(XSSProtection: nil)                                   // the legacy header is not needed
        .with(referrerPolicy: .init(.strictOriginWhenCrossOrigin))
    if production {
        factory.with(strictTransportSecurity: .init(maxAge: 31_536_000, includeSubdomains: true, preload: false))
    }
    return factory.build()
}

x-content-type-options: nosniff
content-security-policy: default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains;
referrer-policy: strict-origin-when-cross-origin

$ curl -si localhost:8097/nope
HTTP/1.1 404 Not Found
content-type: application/json; charset=utf-8
content-security-policy: default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

{"reason":"Not Found","error":true}

# http {} context: 10 MB of state, 5 requests per minute per client address
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

server {
    client_max_body_size 1m;             # reject big bodies before Vapor sees them

    location = /login {
        limit_req zone=login burst=3 nodelay;
        limit_req_status 429;
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header X-Forwarded-For $remote_addr;   # overwrite, never append a client-supplied value
    }
}

// RateLimit.swift
import Vapor
import Redis

struct RateLimitDecision: Sendable, Equatable {
    var allowed: Bool
    var remaining: Int
    /// Seconds until a request would be allowed again (0 when allowed).
    var retryAfter: Int
}

protocol RateLimiter: Sendable {
    func hit(_ key: String, limit: Int, window: Duration) async throws -> RateLimitDecision
}

/// Fixed window in process memory: one counter per key and window. Cheap, but every instance counts separately,
/// and a client can burst up to twice the limit across a window boundary.
actor MemoryFixedWindowLimiter: RateLimiter {
    private struct Bucket { var start: ContinuousClock.Instant; var count: Int }
    private var buckets: [String: Bucket] = [:]
    private let clock = ContinuousClock()

    func hit(_ key: String, limit: Int, window: Duration) async throws -> RateLimitDecision {
        let now = clock.now
        var bucket = buckets[key] ?? Bucket(start: now, count: 0)
        if now - bucket.start >= window { bucket = Bucket(start: now, count: 0) }
        bucket.count += 1
        buckets[key] = bucket
        // Drop expired buckets now and then so that the dictionary cannot grow without bound.
        if buckets.count > 10_000 { buckets = buckets.filter { now - $0.value.start < window } }

        let remainingWindow = window - (now - bucket.start)
        return RateLimitDecision(
            allowed: bucket.count <= limit,
            remaining: max(0, limit - bucket.count),
            retryAfter: bucket.count <= limit ? 0 : Int(remainingWindow.components.seconds) + 1
        )
    }
}

/// Sliding log in process memory: remembers the time of every accepted request in the last window. Exact, but
/// stores up to `limit` timestamps per key.
actor MemorySlidingWindowLimiter: RateLimiter {
    private var log: [String: [ContinuousClock.Instant]] = [:]
    private let clock = ContinuousClock()

    func hit(_ key: String, limit: Int, window: Duration) async throws -> RateLimitDecision {
        let now = clock.now
        var times = (log[key] ?? []).filter { now - $0 < window }
        guard times.count < limit else {
            log[key] = times
            let oldest = times[0]
            let wait = window - (now - oldest)
            return RateLimitDecision(allowed: false, remaining: 0, retryAfter: Int(wait.components.seconds) + 1)
        }
        times.append(now)
        log[key] = times
        return RateLimitDecision(allowed: true, remaining: limit - times.count, retryAfter: 0)
    }
}

/// Fixed window shared by every instance, in Redis. INCR and PEXPIRE run in one Lua script, so a crash between
/// the two cannot leave a counter without an expiry.
struct RedisFixedWindowLimiter: RateLimiter {
    let redis: Application.Redis

    private static let script = """
    local count = redis.call('INCR', KEYS[1])
    if count == 1 then redis.call('PEXPIRE', KEYS[1], ARGV[1]) end
    return {count, redis.call('PTTL', KEYS[1])}
    """

    func hit(_ key: String, limit: Int, window: Duration) async throws -> RateLimitDecision {
        let windowMs = Int(window.components.seconds * 1000)
        let reply = try await redis.send(
            command: "EVAL",
            with: [.init(from: Self.script), .init(from: 1), .init(from: "rl:fixed:\(key)"), .init(from: windowMs)]
        )
        guard let items = reply.array, items.count == 2, let count = items[0].int, let ttlMs = items[1].int else {
            throw Abort(.internalServerError, reason: "Unexpected reply from Redis.")
        }
        return RateLimitDecision(
            allowed: count <= limit,
            remaining: max(0, limit - count),
            retryAfter: count <= limit ? 0 : max(1, (ttlMs + 999) / 1000)
        )
    }
}

/// Sliding log shared by every instance, in a Redis sorted set (score = time in milliseconds).
struct RedisSlidingWindowLimiter: RateLimiter {
    let redis: Application.Redis

    private static let script = """
    local now = tonumber(ARGV[1])
    local window = tonumber(ARGV[2])
    local limit = tonumber(ARGV[3])
    redis.call('ZREMRANGEBYSCORE', KEYS[1], 0, now - window)
    local count = redis.call('ZCARD', KEYS[1])
    if count < limit then
      redis.call('ZADD', KEYS[1], now, ARGV[4])
      redis.call('PEXPIRE', KEYS[1], window)
      return {1, limit - count - 1, 0}
    end
    local oldest = redis.call('ZRANGE', KEYS[1], 0, 0, 'WITHSCORES')
    return {0, 0, tonumber(oldest[2]) + window - now}
    """

    func hit(_ key: String, limit: Int, window: Duration) async throws -> RateLimitDecision {
        let windowMs = Int(window.components.seconds * 1000)
        let nowMs = Int(Date().timeIntervalSince1970 * 1000)   // clocks of the instances should be in sync (NTP)
        let reply = try await redis.send(
            command: "EVAL",
            with: [
                .init(from: Self.script), .init(from: 1), .init(from: "rl:sliding:\(key)"),
                .init(from: nowMs), .init(from: windowMs), .init(from: limit), .init(from: UUID().uuidString),
            ]
        )
        guard let items = reply.array, items.count == 3,
              let allowed = items[0].int, let remaining = items[1].int, let waitMs = items[2].int else {
            throw Abort(.internalServerError, reason: "Unexpected reply from Redis.")
        }
        return RateLimitDecision(allowed: allowed == 1, remaining: remaining, retryAfter: (waitMs + 999) / 1000)
    }
}

/// Applies a limiter to the routes behind it. The key is the client address plus a name for the group of routes.
struct RateLimitMiddleware: AsyncMiddleware {
    let name: String
    let limit: Int
    let window: Duration
    /// Set only when a proxy you control sets `X-Forwarded-For`; otherwise a client can invent its own address.
    let trustForwardedFor: Bool
    /// What to do when the limiter itself fails (Redis down): `true` lets the request through.
    let failOpen: Bool
    let limiter: @Sendable (Request) -> any RateLimiter

    func respond(to req: Request, chainingTo next: any AsyncResponder) async throws -> Response {
        let key = "\(name):\(clientAddress(of: req))"
        let decision: RateLimitDecision
        do {
            decision = try await limiter(req).hit(key, limit: limit, window: window)
        } catch {
            req.logger.error("Rate limiter failed", metadata: ["error": "\(error)", "failOpen": "\(failOpen)"])
            if failOpen { return try await next.respond(to: req) }
            throw Abort(.serviceUnavailable)
        }
        guard decision.allowed else {
            throw Abort(.tooManyRequests, headers: [
                "Retry-After": String(decision.retryAfter),
                "RateLimit-Limit": String(limit),
                "RateLimit-Remaining": "0",
            ])
        }
        let res = try await next.respond(to: req)
        res.headers.replaceOrAdd(name: "RateLimit-Limit", value: String(limit))
        res.headers.replaceOrAdd(name: "RateLimit-Remaining", value: String(decision.remaining))
        return res
    }

    private func clientAddress(of req: Request) -> String {
        if trustForwardedFor,
           let forwarded = req.headers.first(name: "X-Forwarded-For"),
           let last = forwarded.split(separator: ",").last {
            // The proxy appends the address it saw; the right-most entry is the only one a client cannot forge.
            return last.trimmingCharacters(in: .whitespaces)
        }
        return req.remoteAddress?.ipAddress ?? "unknown"
    }
}

$ for i in 1 2 3; do curl -s -o /dev/null -w "%{http_code} " -d 'a=b' localhost:8097/login; done
403 403 429
$ curl -si -d 'a=b' localhost:8097/login
HTTP/1.1 429 Too Many Requests
Retry-After: 55
RateLimit-Limit: 5
RateLimit-Remaining: 0