mORMot Open Source

// configuration section

// URL of application server
var SERVER_URL = "http://localhost";
// model root of application server
var SERVER_ROOT = "r";

// end of configuration section

var MAIN_URL = SERVER_URL + '/' + SERVER_ROOT;

function d2h(d, padding) {
    var hex = Number(d).toString(16);
    padding = typeof (padding) === "undefined" || padding === null ? padding = 2 : padding;

    while (hex.length < padding) {
        hex = "0" + hex;
    }
    return hex;
}

function prf(name) {
    return 'loans_' + name;
}

function getSet(name) {
    return localStorage.getItem(prf(name));
}

function getSetAsInt(name) {
    var c = getSet(name);
    return Number(c) ? c : 0;
}

function setSet(name, value) {
    return localStorage.setItem(prf(name), value);
}

function InitSession() {
    localStorage.removeItem(prf('SESSION_ID'));
    localStorage.removeItem(prf('SESSION_PRIVATE_KEY'));
    localStorage.removeItem(prf('SESSION_LAST_TICK_COUNT'));
    localStorage.removeItem(prf('SESSION_TICK_COUNT_OFFSET'));
    localStorage.removeItem(prf('SESSION_USERNAME'));
    return true;
}

function CloseSession() {
    if (!getSetAsInt('SESSION_ID')) return;

    $.ajax({
        type: "GET",
        dataType: "json",
        url: MAIN_URL + '/auth',
        data: {'session': getSetAsInt('SESSION_ID'), 'UserName': getSet('SESSION_USERNAME')},
        timeout: 2000,
        success: InitSession,
        error: InitSession
    });
}

// converted from TSQLRestClientURI.SessionSign function
function GetSessionSignature(url) {
    // expected format is 'session_signature='Hexa8(SessionID)+Hexa8(TimeStamp)+
    // Hexa8(crc32('SessionID+HexaSessionPrivateKey'+Sha256('salt'+PassWord)+
    // Hexa8(TimeStamp)+url))
    var d = new Date();
    var Tix = d.getTime();
    if (Tix < getSetAsInt('SESSION_LAST_TICK_COUNT')) // wrap around 0 after 49.7 days
        setSet('SESSION_TICK_COUNT_OFFSET', getSetAsInt('SESSION_TICK_COUNT_OFFSET') + 1 << (32 - 8)); // allows 35 years timing
    setSet('SESSION_LAST_TICK_COUNT', Tix);

    var Nonce = d2h(Tix >>> 8 + getSetAsInt('SESSION_TICK_COUNT_OFFSET'), 8);
    var sign = d2h(getSetAsInt('SESSION_ID'), 8) + Nonce + d2h(crc32(getSet('SESSION_PRIVATE_KEY') + Nonce + url), 8);
    var prf = '?';
    if (url.indexOf('?') > -1) prf = '&';
    return  prf + 'session_signature=' + sign;
}

$.ajaxPrefilter(function(options, _, jqXHR) {
    // signing all sended URLs
    if (getSetAsInt('SESSION_ID') > 0 && options.url.indexOf(MAIN_URL) > -1) { // if user authenticated
        var new_url = options.url;
        if (options.data && options.type == "GET")
        {
            new_url += '?' + options.data;
            options.data = null; // or options.data will be added to url by JQuery
        }
        options.url = new_url + GetSessionSignature(new_url.substr(SERVER_URL.length + 1));
        options.cache = true; // we don't want anti-cache "_" JQuery-parameter
    }
});

$(function() {
    if (typeof(localStorage) == 'undefined')
        alert('You do not have HTML5 localStorage support in your browser. Please update or application cannot work as expected');
});

function AuthorizeUser() {
    var name = $("#username").val();
    var pwd = $("#password").val();
    var servnonce = "";

    CloseSession(); // try close previously opened session

    var d = new Date();
    var clientnonce = d.getTime() / (1000 * 60 * 5); // valid for 5*60*1000 ms = 5 minutes;
    clientnonce = SHA256("" + clientnonce);

    var dataString = {'UserName': name};

    $.ajax({
        type: "GET",
        dataType: "json",
        url: MAIN_URL + '/auth',
        data: dataString,
        timeout:2000,
        beforeSend: function(jqXHR, settings) {
            $.blockUI({
                message: '<h1><img src="/images/busy.gif" style="height:16px;width:16px;" /> Авторизуюсь...</h1>',
                css: {
                    border: 'none',
                    padding: '15px',
                    backgroundColor: '#000',
                    '-webkit-border-radius': '10px',
                    '-moz-border-radius': '10px',
                    opacity: .5,
                    color: '#fff'
                } });
        },
        success: function(data, textStatus, jqXHR) {
            servnonce = data.result;
            // The Password parameter as sent for the 2nd request will be computed as
            // ! Sha256(ModelRoot+Nonce+ClientNonce+UserName+Sha256('salt'+PassWord))
            var password = SHA256(SERVER_ROOT + servnonce + clientnonce + name + SHA256('salt' + pwd));
            dataString = {'UserName': name, 'Password': password, 'ClientNonce': clientnonce};

            // second handshake
            $.ajax({
                type: "GET",
                dataType: "json",
                url: MAIN_URL + '/auth',
                data: dataString,
                timeout: 2000,

                success: function(data, textStatus, jqXHR) {
                    var p = data.result.indexOf('+');
                    if (p > -1) {
                        setSet('SESSION_ID', data.result.substr(0, p));
                        setSet('SESSION_PRIVATE_KEY', data.result + SHA256('salt' + pwd));
                        setSet('SESSION_USERNAME', name);

                        // get session info
                        $.ajax({
                            type: "GET",
                            dataType: "json",
                            url: MAIN_URL + '/GetSessionInfo',
                            timeout: 2000,
                            success: function(data) {
                                create_notify("msgs", { title:'Welcome', text:'You are successfully authenticated', icon:'check48.png' });
                                setSet('SESSION_GROUP', data.group);
                                setSet('SESSION_FIO', data.fio);
                                setTimeout(function() {
                                    document.location = '/pages/main_' + data.group + '.htm';
                                }, 1000);
                            }
                        });
                        $.unblockUI();

                        return true;
                    }
                },
                error: function (jqXHR, textStatus, errorThrown) {
                    if (jqXHR.status == 404) {
                        create_notify('msgs', {title:'Authentication error', text:'Sorry, wrong username or password', icon:'error48.png'});
                        $("#login section").effect("shake", 150);
                        $.unblockUI();
                        return
                    }
                }
            }); // end success of second handshake
        } // end success of first handshake
    });

    return false; // end of AuthorizeUser
}

$(function() {
    // Call the button widget method on the login button to format it.
    $("#btnLogin").button().bind("click", function() {
        AuthorizeUser();
        return false;
    });
});

...
       try
          User := nil; // will be freed by TAuthSession.Destroy
          aResp := Session.fPrivateSalt;
          if fSessions=nil then
...

...
        try
          User := nil; // will be freed by TAuthSession.Destroy
          aResp := JSONEncodeResult([Session.fPrivateSalt]);

          if fSessions=nil then
...

...
    begin
      // only UserName=... -> return hexadecimal nonce content valid for 5 minutes
      aResp := Nonce(false);
    end;
...

...
    begin
      // only UserName=... -> return hexadecimal nonce content valid for 5 minutes
      aResp := JSONEncodeResult([Nonce(false)]);
    end;
...

if (typeof(crc) == "undefined") { crc = 0; }

crc = 0;