fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686)

1. Remember the last token that has been rotated and skip its validation
2. Don't alarm when the token mismatch occurs in a short window

services/auth/auth_token.go

@@ -25,15 +25,12 @@ import (
 
 var (
 	ErrAuthTokenInvalidFormat = util.NewInvalidArgumentErrorf("auth token has an invalid format")
+	ErrAuthTokenStale         = util.NewInvalidArgumentErrorf("auth token has been rotated")
 	ErrAuthTokenExpired       = util.NewInvalidArgumentErrorf("auth token has expired")
 	ErrAuthTokenInvalidHash   = util.NewInvalidArgumentErrorf("auth token is invalid")
 )
 
 func CheckAuthToken(ctx context.Context, value string) (*auth_model.AuthToken, error) {
-	if len(value) == 0 {
-		return nil, nil //nolint:nilnil // the auth method is not applicable
-	}
-
 	parts := strings.SplitN(value, ":", 2)
 	if len(parts) != 2 {
 		return nil, ErrAuthTokenInvalidFormat
@@ -53,7 +50,12 @@ func CheckAuthToken(ctx context.Context, value string) (*auth_model.AuthToken, e
 
 	hashedToken := sha256.Sum256([]byte(parts[1]))
 
-	if !util.CryptoConstTimeEqual(t.TokenHash, hex.EncodeToString(hashedToken[:])) {
+	hash := hex.EncodeToString(hashedToken[:])
+	if !util.CryptoConstTimeEqual(t.TokenHash, hash) {
+		// Recently rotated cookies can still be in flight, but must not authenticate.
+		if t.RotatedUnix.AddDuration(time.Minute) >= timeutil.TimeStampNow() && util.CryptoConstTimeEqual(t.PreviousTokenHash, hash) {
+			return nil, ErrAuthTokenStale
+		}
 		// If an attacker steals a token and uses the token to create a new session the hash gets updated.
 		// When the victim uses the old token the hashes don't match anymore and the victim should be notified about the compromised token.
 		// Revoke the token so the attacker's rotated token (which shares this ID) can no longer be used.
@@ -70,15 +72,21 @@ func RegenerateAuthToken(ctx context.Context, t *auth_model.AuthToken) (*auth_mo
 	token, hash := generateTokenAndHash()
 
 	newToken := &auth_model.AuthToken{
-		ID:          t.ID,
-		TokenHash:   hash,
-		UserID:      t.UserID,
-		ExpiresUnix: timeutil.TimeStampNow().AddDuration(time.Duration(setting.LogInRememberDays*24) * time.Hour),
+		ID:                t.ID,
+		TokenHash:         hash,
+		PreviousTokenHash: t.TokenHash,
+		RotatedUnix:       timeutil.TimeStampNow(),
+		UserID:            t.UserID,
+		ExpiresUnix:       timeutil.TimeStampNow().AddDuration(time.Duration(setting.LogInRememberDays*24) * time.Hour),
 	}
 
-	if err := auth_model.UpdateAuthTokenByID(ctx, newToken); err != nil {
+	updated, err := auth_model.UpdateAuthTokenByID(ctx, newToken, t.TokenHash)
+	if err != nil {
 		return nil, "", err
 	}
+	if !updated {
+		return nil, "", ErrAuthTokenStale
+	}
 
 	return newToken, token, nil
 }

services/auth/auth_token_test.go

@@ -13,6 +13,7 @@ import (
 	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCheckAuthToken(t *testing.T) {
@@ -20,7 +21,7 @@ func TestCheckAuthToken(t *testing.T) {
 
 	t.Run("Empty", func(t *testing.T) {
 		token, err := CheckAuthToken(t.Context(), "")
-		assert.NoError(t, err)
+		assert.ErrorIs(t, err, ErrAuthTokenInvalidFormat)
 		assert.Nil(t, token)
 	})
 
@@ -105,5 +106,20 @@ func TestRegenerateAuthToken(t *testing.T) {
 	assert.NotEqual(t, token, token2)
 	assert.NotEqual(t, at.ExpiresUnix, at2.ExpiresUnix)
 
+	// A second request validated the same cookie before the first rotation.
+	_, _, err = RegenerateAuthToken(t.Context(), at)
+	require.ErrorIs(t, err, ErrAuthTokenStale)
+
+	_, err = CheckAuthToken(t.Context(), at.ID+":"+token)
+	require.ErrorIs(t, err, ErrAuthTokenStale)
+	current, err := CheckAuthToken(t.Context(), at2.ID+":"+token2)
+	require.NoError(t, err)
+	require.Equal(t, at2.TokenHash, current.TokenHash)
+
+	timeutil.MockSet(time.Date(2023, 1, 1, 0, 1, 2, 0, time.UTC))
+	_, err = CheckAuthToken(t.Context(), at.ID+":"+token)
+	require.ErrorIs(t, err, ErrAuthTokenInvalidHash)
+	_, err = auth_model.GetAuthTokenByID(t.Context(), at.ID)
+	require.ErrorIs(t, err, util.ErrNotExist)
 	assert.NoError(t, auth_model.DeleteAuthTokenByID(t.Context(), at.ID))
 }