[FEATURE] Send cryptographically secure nonce with login request, verify on token receipt

[isaacs]

Why

While the web login design is more secure than the CouchDB style login, it still is potentially vulnerable to a MITM where an attacker injects a malicious token.

The current flow works like this:

cli                                           registry
------------------------------------------------------
  POST /-/v1/login {} -->
                           <-- 200 {doneUrl, loginUrl}

(opens $loginUrl in web browser)

  GET $doneUrl -->


              (possible "retry"/state-change update)
                           <-- 202 retry-after
  (wait $retry-after seconds)
  GET $doneUrl -->

                           <-- 200 {token}

Proposal

Include a cryptographically secure nonce in the initial request.

If provided in the initial request, the registry MUST repeat the nonce back in the final token response.

cli                                           registry
------------------------------------------------------
  POST /-/v1/login {nonce} -->
                           <-- 200 {doneUrl, loginUrl}

(opens $loginUrl in web browser)

  GET $doneUrl -->


              (possible "retry"/state-change update)
                           <-- 202 retry-after
  (wait $retry-after seconds)
  GET $doneUrl -->

                           <-- 200 {token, nonce}
(verify nonce, fail if missing or not matching)

This will have to be implemented on the registry (and in npmE) first, and only incorporated into this library once supported.

Registry MUST accept requests without a nonce, and not include a nonce if the initial request did not include one.

Threat Model Improvement

An attacker must MITM the entire transaction (or at least, the initial POST) in order to provide a malicious token, whereas currently, they only have to get in front of the final 200 response.

[isaacs]

cc: @wraithgar @nlf @djsauble, tangential to our conversations on extending login and rolling out web login for all.

[isaacs]

Consensus seems to be that UUID v4 is fine as a nonce. Use that.