Using the serialize Function¶ It is an inbuilt PHP function that is used for serializing a particular array. It accepts only one parameter that is the data one intends to serialize. The serialize function is capable of returning a serialized string. The syntax of the serialize function is. Injection bugs in Node.js. I thought to do some research on this and after spending some time I was able to exploit a deserialization bug to achieve arbitrary code injection. Building the Payload I have used node-serialize version 0.0.4 for this research. The format produced by PHP's serialize function is PHP specific and so the best option is to use PHP's unserialize to have 100% guarantee that it is doing the job right. PHP can store class information in those strings and even the output of some custom serialization methods. Serialize(mixed$value): string Generates a storable representation of a value. This is useful for storing or passing PHP values around without losing their type and structure. The JSON.stringify method converts a JavaScript object or value to a JSON string, optionally replacing values if a replacer function is specified or optionally including only the specified properties if a replacer array is specified.
Do I implement Serialize and Deserialize?
RedisStore is setup as my session store with Express. Does this mean that I DO NOT implement Serialize and Deserialize? Will it happen automatically?
When I don’t implement these methods I get the following Express error – 500 Error: failed to serialize user into session. When I do implement them I’m not sure what to put in the Deserialize.
The code below appears to work but the sessions are not persisting. I need to login everytime I visit the site.
Is there a good example anywhere of NodeJS + Passport + RedisStore?
If you are using sessions you have to provide passport with a serialize and deserialize function. Implementing Redis as a session store has nothing to do with how passport was implement, it only deals with where the session data is stored.
Implementing Sessions with passport
As I said, the serialize and deserialize functions must be provided to passport for sessions to work.
Php Serialize Data
The purpose of the serialize function is to return sufficient identifying information to recover the user account on any subsequent requests. Specifically the the second parameter of the done() method is the information serialized into the session data.
The deserialize function that you provide is intended to return the user profile based on the identifying information that was serialized to the session.
Here is the example from the Passport Guide in the section discussing sessions:
In the above example passport.serializeUser() is provided a function that takes two parameters, the user profile (user) and a callback function (done). The callback function takes as it’s second parameter the identifying information (user.id, but if you’re using mongoDB this may be user._id) required to recover the account from the database. This will be called on every authenticated request and stores the identifying information in the session data (whether that is in a cookie or your Redis store).
passport.deserializeUser() is provided a function that also takes two parameters, the identifying information (id) and again a callback function (done). The identifying information is what was serialized to the session data in the previous request (user.id). The callback function here requires the user profile as it’s second parameter, or any error in raised in retrieving the profile as it’s first parameter. The User.findById() function is a lookup function for the user profile in the database. In this example User object is an instance of a mongoose model which has the findById() function.
The function provided to passport.deserializeUser() is called by the passport middleware, passport.session() prior to the route handling to store the user profile (user) to req.user.
Implementing Redis as a Session Store
The purpose of using Redis is to store session data server side so the only data stored client side is the session id. Again, this is independant of how you have implemented passport, passport doesn’t care where the session data is being stored as long as you have added session support to your app. This previos question on stackoverflow addresses how to implement Redis
Bit late but i have made this visual thing to understand
- When and how is is an strategy/local/Facebook/etc called and how it gets to req.login or passport.serializeUser() and whats with done()?
passport.authenticate() invokes the respective strategy you provide as an argument, there you match req.body.password and req.body.username with the database stored or in memory stored password and username. if user found you pass it to done() as second argument else you return false
The done callback return back to passport.authenticate(). if done is called previously with user (ie done(null,user); ) than req,logIn() is called automatically or by user behind the scene
req.logIn() calls passport.serializeUser()
- Whats passport.serializeUser and Where does user.some_key go after this function has been called?
the key of user object you provide in second argument of the done in serialize function is saved in session and is used to retrieve the whole object via deserialize function.
Serialize function determine what data from the user object should be stored in the session. The result of the serializeUser method is attached to the session as req.session.passport.user = {} here for instance it would be(as we provide id as key) req.session.passport.user = {id:'xyz'}
- What is passport.deserializeUser and where does it fit in the workflow?
In deserialize function you provide in first argument of deserialize function that same key of user object that was given to done function in serialize call. so your whole object is retrieved with help of that key. that key here is id(key can be any key of the user object ie name,email etc)
In deSerialize function that key is matched with in memory array / database or any data resource
The fetched object is attached to request object as req.user
id key can be any key of the user object ie name,email etc
Visual Flow
here id key can be any key of the user object ie name,email etc
Given the following configuration of express-session with connect-redis as the session store (using Express 4):
You can just tell passport to serialize the entire user object, instead of just the user id.
The entire user object will be saved with the session in Redis, and placed on the request as req.user for every request.
According to the documentation:'It is critical to select a serialization scheme which is deterministic across executions of the transaction, across platforms, and across versions of the serialization framework. Data structures which don’t enforce ordered serialization (e.g. sets, maps, dicts) should be avoided.'https://sawtooth.hyperledger.org/docs/core/releases/1.2.6/architecture/global_state.html?highlight=deterministic
Because in javascript most variables are maps, it's not clear how one should should store data.
Js Serialize Function
Thus, storing general JSON data would seem to be a bad idea, as in:
Php Serialize Online
Although JSON.stringify is to a certain extent deterministic (Is JSON.stringify() deterministic in V8?)
Also cbor and protobuff might not be recommended because they do not enforce an ordering:
'The CBOR data model for maps does not allow ascribing semantics tothe order of the key/value pairs in the map representation.'https://tools.ietf.org/html/rfc7049
'By default, repeated invocations of serialization methods on the same protocol buffer message instance may not return the same byte output; i.e. the default serialization is not deterministic.'https://developers.google.com/protocol-buffers/docs/encoding
'Wire format ordering and map iteration ordering of map values is undefined, so you cannot rely on your map items being in a particular order.'https://developers.google.com/protocol-buffers/docs/proto3#maps
From the documentation the only examples I've seen are storing a String with a specific format:https://github.com/hyperledger/sawtooth-sdk-javascript/blob/master/examples/xo/state.js
Or storing a single cbor encoded value:https://github.com/hyperledger/sawtooth-sdk-javascript/blob/master/examples/intkey/handler.js
However, both approaches seem very limited.