24 |
27 |
28 |
54 | 
378 |
378 |
379 |
380 | ## Future Features
381 |
382 | - Additional authentication methods
383 |
384 | > Got an idea? Open an issue or submit a PR
385 |
--------------------------------------------------------------------------------
/server.js:
--------------------------------------------------------------------------------
1 | require('dotenv').config();
2 | const express = require('express');
3 | const session = require('express-session');
4 | const crypto = require('crypto');
5 | const path = require('path');
6 | const cookieParser = require('cookie-parser');
7 | const cors = require('cors');
8 | const { WebSocketServer } = require('ws');
9 | const http = require('http');
10 | const pty = require('node-pty');
11 | const os = require('os');
12 | const { generatePWAManifest } = require("./scripts/pwa-manifest-generator");
13 | const { originValidationMiddleware, getCorsOptions, validateOrigin } = require('./scripts/cors');
14 |
15 | const app = express();
16 | const server = http.createServer(app);
17 |
18 | const PORT = process.env.PORT || 3000;
19 | const DEBUG = process.env.DEBUG === 'TRUE';
20 | const NODE_ENV = process.env.NODE_ENV || 'production';
21 | const BASE_URL = process.env.BASE_URL || `http://localhost:${PORT}`;
22 | const DEMO_MODE = process.env.DEMO_MODE === 'true';
23 | const SITE_TITLE = DEMO_MODE ? `${process.env.SITE_TITLE || 'DumbTerm'} (DEMO)` : (process.env.SITE_TITLE || 'DumbTerm');
24 | const APP_VERSION = require('./package.json').version;
25 | const PUBLIC_DIR = path.join(__dirname, 'public');
26 | const ptyModule = DEMO_MODE ? require('./scripts/demo/terminal') : pty;
27 | const ASSETS_DIR = path.join(PUBLIC_DIR, 'assets');
28 | const CACHE_NAME = `DUMBTERM_CACHE_V${APP_VERSION}`;
29 |
30 | generatePWAManifest(SITE_TITLE);
31 |
32 | function debugLog(...args) {
33 | if (DEBUG) {
34 | console.log('[DEBUG]', ...args);
35 | }
36 | }
37 |
38 | // Base URL configuration
39 | const BASE_PATH = (() => {
40 | if (!BASE_URL) {
41 | debugLog('No BASE_URL set, using empty base path');
42 | return '';
43 | }
44 | try {
45 | const url = new URL(BASE_URL);
46 | const path = url.pathname.replace(/\/$/, ''); // Remove trailing slash
47 | debugLog('Base URL Configuration:', {
48 | originalUrl: BASE_URL,
49 | extractedPath: path,
50 | protocol: url.protocol,
51 | hostname: url.hostname
52 | });
53 | return path;
54 | } catch {
55 | // If BASE_URL is just a path (e.g. /app)
56 | const path = BASE_URL.replace(/\/$/, '');
57 | debugLog('Using direct path as BASE_URL:', path);
58 | return path;
59 | }
60 | })();
61 |
62 | // Get the project name from package.json to use for the PIN environment variable
63 | const projectName = require('./package.json').name.toUpperCase().replace(/-/g, '_');
64 | const PIN = process.env[`${projectName}_PIN`];
65 | const isPinRequired = PIN && PIN.trim() !== '';
66 |
67 | // Log whether PIN protection is enabled
68 | if (isPinRequired) {
69 | debugLog('PIN protection is enabled, PIN length:', PIN.length);
70 | } else {
71 | debugLog('PIN protection is disabled');
72 | }
73 |
74 | // Brute force protection
75 | const loginAttempts = new Map();
76 | const MAX_ATTEMPTS = 5;
77 | const LOCKOUT_TIME = (process.env.LOCKOUT_TIME || 15) * 60 * 1000; // default 15 minutes in milliseconds
78 | const MAX_SESSION_AGE = (process.env.MAX_SESSION_AGE || 24) * 60 * 60 * 1000 // default 24 hours
79 |
80 | function resetAttempts(ip) {
81 | debugLog('Resetting login attempts for IP:', ip);
82 | loginAttempts.delete(ip);
83 | }
84 |
85 | function isLockedOut(ip) {
86 | const attempts = loginAttempts.get(ip);
87 | if (!attempts) return false;
88 |
89 | if (attempts.count >= MAX_ATTEMPTS) {
90 | const timeElapsed = Date.now() - attempts.lastAttempt;
91 | if (timeElapsed < LOCKOUT_TIME) {
92 | debugLog('IP is locked out:', ip, 'Time remaining:', Math.ceil((LOCKOUT_TIME - timeElapsed) / 1000 / 60), 'minutes');
93 | return true;
94 | }
95 | resetAttempts(ip);
96 | }
97 | return false;
98 | }
99 |
100 | function recordAttempt(ip) {
101 | const attempts = loginAttempts.get(ip) || { count: 0, lastAttempt: 0 };
102 | attempts.count += 1;
103 | attempts.lastAttempt = Date.now();
104 | loginAttempts.set(ip, attempts);
105 | debugLog('Login attempt recorded for IP:', ip, 'Count:', attempts.count);
106 | }
107 |
108 | // Security middleware
109 | app.set('trust proxy', 1);
110 | app.use(cors(getCorsOptions(BASE_URL)));
111 | app.use(express.json());
112 | app.use(cookieParser());
113 |
114 | // Session configuration with secure settings
115 | app.use(session({
116 | secret: crypto.randomBytes(32).toString('hex'),
117 | resave: false,
118 | saveUninitialized: false,
119 | cookie: {
120 | secure: (BASE_URL.startsWith('https') && NODE_ENV === 'production'),
121 | httpOnly: true,
122 | sameSite: 'strict',
123 | maxAge: MAX_SESSION_AGE
124 | }
125 | }));
126 |
127 | const requirePin = (req, res, next) => {
128 | if (!PIN || !isValidPin(PIN)) {
129 | return next();
130 | }
131 |
132 | const authCookie = req.cookies[COOKIE_NAME];
133 | if (!authCookie || !secureCompare(authCookie, PIN)) {
134 | return res.status(401).json({ error: 'Unauthorized' });
135 | }
136 | next();
137 | };
138 |
139 | // Constant-time PIN comparison to prevent timing attacks
140 | const verifyPin = (storedPin, providedPin) => {
141 | if (!storedPin || !providedPin) return false;
142 | if (storedPin.length !== providedPin.length) return false;
143 |
144 | try {
145 | return crypto.timingSafeEqual(
146 | Buffer.from(storedPin),
147 | Buffer.from(providedPin)
148 | );
149 | } catch {
150 | return false;
151 | }
152 | }
153 |
154 | // Authentication middleware
155 | const authMiddleware = (req, res, next) => {
156 | debugLog('Auth check for path:', req.path, 'Method:', req.method);
157 |
158 | // If no PIN is set or PIN is empty, bypass authentication completely
159 | if (!PIN || PIN.trim() === '') {
160 | debugLog('Auth bypassed - No PIN configured');
161 | req.session.authenticated = true; // Set session as authenticated
162 | return next();
163 | }
164 |
165 | // First check if user is authenticated via session
166 | if (req.session.authenticated) {
167 | debugLog('Auth successful - Valid session found');
168 | return next();
169 | }
170 |
171 | // If not authenticated via session, check for valid PIN cookie
172 | const pinCookie = req.cookies[`${projectName}_PIN`];
173 | if (pinCookie && verifyPin(PIN, pinCookie)) {
174 | debugLog('Auth successful - Valid PIN cookie found, restoring session');
175 | req.session.authenticated = true;
176 | return next();
177 | }
178 |
179 | // No valid session or PIN cookie found
180 | debugLog('Auth failed - No valid session or PIN cookie, redirecting to login');
181 | return res.redirect(BASE_PATH + '/login');
182 | };
183 |
184 | // Global middleware for origin validation and authentication
185 | app.use(BASE_PATH, (req, res, next) => {
186 | // List of paths that should be publicly accessible
187 | const publicPaths = [
188 | '/login',
189 | '/pin-length',
190 | '/verify-pin',
191 | '/config.js',
192 | '/assets/',
193 | '/fonts/',
194 | '/styles.css',
195 | '/manifest.json',
196 | '/asset-manifest.json',
197 | ];
198 |
199 | // Check if the current path matches any of the public paths
200 | if (publicPaths.some(path => req.path.startsWith(path))) {
201 | return next();
202 | }
203 |
204 | // For all other paths, apply both origin validation and auth middleware
205 | originValidationMiddleware(req, res, () => {
206 | authMiddleware(req, res, next);
207 | });
208 | });
209 |
210 | // Routes start here...
211 | app.get(BASE_PATH + '/', (req, res) => {
212 | res.sendFile(path.join(__dirname, 'public', 'index.html'));
213 | });
214 |
215 | // Serve config.js for frontend
216 | app.get(BASE_PATH + '/config.js', (req, res) => {
217 | debugLog('Serving config.js with basePath:', BASE_PATH);
218 | const appConfig = {
219 | basePath: BASE_PATH,
220 | debug: DEBUG,
221 | siteTitle: SITE_TITLE,
222 | isPinRequired: isPinRequired,
223 | isDemoMode: DEMO_MODE,
224 | version: APP_VERSION,
225 | cacheName: CACHE_NAME
226 | }
227 |
228 | res.type('application/javascript').send(`
229 | window.appConfig = ${JSON.stringify(appConfig)};
230 | `);
231 | });
232 |
233 | // Serve static files for public assets
234 | app.use(BASE_PATH + '/', express.static(path.join(PUBLIC_DIR)));
235 | app.get(BASE_PATH + "/manifest.json", (req, res) => {
236 | res.sendFile(path.join(ASSETS_DIR, "manifest.json"));
237 | });
238 | app.get(BASE_PATH + "/asset-manifest.json", (req, res) => {
239 | res.sendFile(path.join(ASSETS_DIR, "asset-manifest.json"));
240 | });
241 | // Serve font files
242 | app.use('/fonts', express.static(path.join(PUBLIC_DIR, 'fonts')));
243 | app.use('/node_modules/@xterm/', express.static(
244 | path.join(__dirname, 'node_modules/@xterm/')
245 | ));
246 |
247 | // Routes
248 | app.get(BASE_PATH + '/login', (req, res) => {
249 | // Check if PIN is required
250 | if (!PIN || PIN.trim() === '') {
251 | return res.redirect(BASE_PATH + '/');
252 | }
253 |
254 | // Check authentication first
255 | if (req.session.authenticated) {
256 | return res.redirect(BASE_PATH + '/');
257 | }
258 |
259 |
260 | // Check if user is already authenticated by PIN
261 | const pinCookie = req.cookies[`${projectName}_PIN`];
262 | if (verifyPin(PIN, pinCookie)) {
263 | return res.redirect(BASE_PATH + '/');
264 | }
265 |
266 | res.sendFile(path.join(__dirname, 'public', 'login.html'));
267 | });
268 |
269 | app.get(BASE_PATH + '/pin-length', (req, res) => {
270 | // If no PIN is set, return 0 length
271 | if (!PIN || PIN.trim() === '') {
272 | return res.json({ length: 0 });
273 | }
274 | res.json({ length: PIN.length });
275 | });
276 |
277 | app.post(BASE_PATH + '/verify-pin', (req, res) => {
278 | debugLog('PIN verification attempt from IP:', req.ip);
279 |
280 | // If no PIN is set, authentication is successful
281 | if (!PIN || PIN.trim() === '') {
282 | debugLog('PIN verification bypassed - No PIN configured');
283 | req.session.authenticated = true;
284 | return res.status(200).json({ success: true });
285 | }
286 |
287 | const ip = req.ip;
288 |
289 | // Check if IP is locked out
290 | if (isLockedOut(ip)) {
291 | const attempts = loginAttempts.get(ip);
292 | const timeLeft = Math.ceil((LOCKOUT_TIME - (Date.now() - attempts.lastAttempt)) / 1000 / 60);
293 | debugLog('PIN verification blocked - IP is locked out:', ip);
294 | return res.status(429).json({
295 | error: `Too many attempts. Please try again in ${timeLeft} minutes.`
296 | });
297 | }
298 |
299 | const { pin } = req.body;
300 |
301 | if (!pin || typeof pin !== 'string') {
302 | debugLog('PIN verification failed - Invalid PIN format');
303 | return res.status(400).json({ error: 'Invalid PIN format' });
304 | }
305 |
306 | // Verify PIN first
307 | const isPinValid = verifyPin(PIN, pin);
308 |
309 | if (isPinValid) {
310 | debugLog('PIN verification successful');
311 | // Reset attempts on successful login
312 | resetAttempts(ip);
313 |
314 | // Set authentication in session immediately
315 | req.session.authenticated = true;
316 |
317 | // Set secure cookie
318 | res.cookie(`${projectName}_PIN`, pin, {
319 | httpOnly: true,
320 | secure: req.secure || (BASE_URL.startsWith('https') && NODE_ENV === 'production'),
321 | sameSite: 'strict',
322 | maxAge: MAX_SESSION_AGE
323 | });
324 |
325 | // Add artificial delay before sending response
326 | setTimeout(() => {
327 | // Redirect to main page on success
328 | res.redirect(BASE_PATH + '/');
329 | }, crypto.randomInt(50, 150));
330 | } else {
331 | debugLog('PIN verification failed - Invalid PIN');
332 | // Record failed attempt
333 | recordAttempt(ip);
334 |
335 | const attempts = loginAttempts.get(ip);
336 | const attemptsLeft = MAX_ATTEMPTS - attempts.count;
337 |
338 | // Add artificial delay before sending error response
339 | setTimeout(() => {
340 | res.status(401).json({
341 | error: 'Invalid PIN',
342 | attemptsLeft: Math.max(0, attemptsLeft)
343 | });
344 | }, crypto.randomInt(50, 150));
345 | }
346 | });
347 |
348 | app.get(BASE_PATH + '/api/require-pin', (req, res) => {
349 | // If no PIN is set, return success
350 | if (!PIN || PIN.trim() === '') {
351 | return res.json({ success: true, required: false });
352 | }
353 |
354 | // Check for PIN cookie
355 | const pinCookie = req.cookies[`${projectName}_PIN`];
356 | if (!pinCookie || !verifyPin(PIN, pinCookie)) {
357 | return res.json({ success: false, required: true });
358 | }
359 |
360 | // Valid PIN cookie found
361 | return res.json({ success: true, required: true });
362 | });
363 |
364 | // Logout endpoint
365 | app.post(BASE_PATH + '/logout', (req, res) => {
366 | debugLog('Logout request received');
367 |
368 | const cookieOptions = {
369 | httpOnly: true,
370 | secure: req.secure || (BASE_URL.startsWith('https') && NODE_ENV === 'production'),
371 | sameSite: 'strict',
372 | path: BASE_PATH || '/', // Match the path used when setting cookies
373 | expires: new Date(0), // Immediately expire the cookie
374 | maxAge: 0 // Belt and suspenders - also set maxAge to 0
375 | };
376 |
377 | // Clear both cookies with consistent options
378 | res.clearCookie(`${projectName}_PIN`, cookieOptions);
379 | res.clearCookie('connect.sid', cookieOptions);
380 |
381 | // Destroy the session and wait for it to be destroyed before sending response
382 | req.session.destroy((err) => {
383 | if (err) {
384 | debugLog('Error destroying session:', err);
385 | return res.status(500).json({ success: false, error: 'Failed to logout properly' });
386 | }
387 | debugLog('Session and cookies cleared successfully');
388 | res.json({ success: true });
389 | });
390 | });
391 |
392 | // WebSocket server configuration
393 | const wss = new WebSocketServer({
394 | server,
395 | verifyClient: (info, callback) => {
396 | debugLog('Verifying WebSocket connection from:', info.req.headers.origin);
397 |
398 | const isOriginValid = validateOrigin(info.req.headers.origin);
399 | if (isOriginValid) callback(true); // allow the connection
400 | else {
401 | console.warn("Blocked connection from origin:", {origin});
402 | callback(false, 403, 'Forbidden'); // reject the connection
403 | }
404 | }
405 | });
406 |
407 | // WebSocket connection handling
408 | wss.on('connection', (ws, req) => {
409 | debugLog('New WebSocket connection attempt');
410 |
411 | // Keep track of connection status
412 | ws.isAlive = true;
413 |
414 | // Setup ping/pong heartbeat
415 | ws.on('pong', () => {
416 | ws.isAlive = true;
417 | debugLog('Received pong from client');
418 | });
419 |
420 | // Handle connection errors
421 | ws.on('error', (error) => {
422 | debugLog('WebSocket error:', error);
423 | ws.terminate();
424 | });
425 |
426 | // If no PIN is set, allow the connection
427 | if (!PIN || PIN.trim() === '') {
428 | debugLog('No PIN required, creating terminal');
429 | createTerminal(ws);
430 | return;
431 | }
432 |
433 | if (!req.headers.cookie) {
434 | debugLog('No cookies found, closing connection');
435 | ws.close(1008, 'Authentication required'); // Use 1008 for policy violation
436 | return;
437 | }
438 |
439 | // Parse the cookies
440 | const parsedCookies = {};
441 | req.headers.cookie.split(';').forEach(cookie => {
442 | const parts = cookie.split('=');
443 | parsedCookies[parts[0].trim()] = parts[1].trim();
444 | });
445 |
446 | // Check if the user has the correct PIN cookie
447 | const pinCookie = parsedCookies[`${projectName}_PIN`];
448 | if (!pinCookie || !verifyPin(PIN, pinCookie)) {
449 | debugLog('Invalid PIN cookie, closing connection');
450 | ws.close(1008, 'Authentication required'); // Use 1008 for policy violation
451 | return;
452 | }
453 |
454 | debugLog('Authentication successful, creating terminal');
455 | createTerminal(ws);
456 | });
457 |
458 | // Heartbeat check interval with more frequent checks
459 | const heartbeatInterval = setInterval(() => {
460 | wss.clients.forEach((ws) => {
461 | if (ws.isAlive === false) {
462 | debugLog('Terminating inactive WebSocket connection');
463 | return ws.terminate();
464 | }
465 | ws.isAlive = false;
466 | try {
467 | ws.ping();
468 | } catch (err) {
469 | debugLog('Error sending ping:', err);
470 | ws.terminate();
471 | }
472 | });
473 | }, 15000); // Check every 15 seconds
474 |
475 | // Clean up interval on server shutdown
476 | process.on('SIGTERM', () => {
477 | clearInterval(heartbeatInterval);
478 | wss.close();
479 | });
480 |
481 | // Terminal creation helper function
482 | function createTerminal(ws) {
483 | // Create terminal process
484 | const shell = process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : 'bash');
485 |
486 | const term = ptyModule.spawn(shell, [], {
487 | name: 'xterm-256color',
488 | cols: 80,
489 | rows: 24,
490 | cwd: DEMO_MODE ? '/home/demo' : (process.env.HOME || '/root'),
491 | env: {
492 | ...process.env,
493 | TERM: 'xterm-256color',
494 | COLORTERM: 'truecolor',
495 | LANG: 'en_US.UTF-8',
496 | // Force buffer flushing for better alternate buffer handling
497 | STDBUF: 'L',
498 | // Ensure proper handling of alternate buffer in applications
499 | TERM_PROGRAM: 'xterm-256color'
500 | }
501 | });
502 |
503 | debugLog(`Terminal created with PID: ${term.pid}${DEMO_MODE ? ' (Demo Mode)' : ''}`);
504 |
505 | // Handle incoming data from client
506 | ws.on('message', (data) => {
507 | try {
508 | const message = JSON.parse(data);
509 | switch(message.type) {
510 | case 'input':
511 | term.write(message.data);
512 | break;
513 | case 'resize':
514 | term.resize(message.cols, message.rows);
515 | break;
516 | }
517 | } catch (error) {
518 | debugLog('Error processing WebSocket message:', error);
519 | }
520 | });
521 |
522 | // Handle terminal data with control sequence filtering
523 | term.on('data', (data) => {
524 | if (ws.readyState === ws.OPEN) {
525 | // Raw send without any filtering - let the client handle buffer switches
526 | ws.send(JSON.stringify({
527 | type: 'output',
528 | data: data
529 | }));
530 | }
531 | });
532 |
533 | // Clean up on close
534 | ws.on('close', () => {
535 | debugLog('WebSocket closed, killing terminal process:', term.pid);
536 | term.kill();
537 | });
538 |
539 | // Handle terminal exit
540 | term.on('exit', (code) => {
541 | debugLog('Terminal process exited with code:', code);
542 | if (ws.readyState === ws.OPEN) {
543 | ws.close();
544 | }
545 | });
546 | }
547 |
548 | // Cleanup old lockouts periodically
549 | setInterval(() => {
550 | const now = Date.now();
551 | for (const [ip, attempts] of loginAttempts.entries()) {
552 | if (now - attempts.lastAttempt >= LOCKOUT_TIME) {
553 | loginAttempts.delete(ip);
554 | }
555 | }
556 | }, 60000); // Clean up every minute
557 |
558 | // Update server.listen to use the http server
559 | server.listen(PORT, () => {
560 | debugLog('Server Configuration:', {
561 | port: PORT,
562 | basePath: BASE_PATH,
563 | pinProtection: isPinRequired,
564 | nodeEnv: NODE_ENV,
565 | debug: DEBUG,
566 | demoMode: DEMO_MODE,
567 | version: APP_VERSION,
568 | cacheName: CACHE_NAME
569 | });
570 | console.log(`Server running on: ${BASE_URL}`);
571 | });
--------------------------------------------------------------------------------
/public/service-worker.js:
--------------------------------------------------------------------------------
1 | // Core service worker configuration
2 | let CACHE_VERSION = "1.0.0"; // Default fallback version
3 | let CACHE_NAME = `DUMBTERM_CACHE_V${CACHE_VERSION}`; // Default format, will be overridden
4 | const ASSETS_TO_CACHE = [];
5 | const BASE_PATH = self.registration.scope;
6 |
7 | /**
8 | * Gets app configuration from config.js
9 | * @returns {Promise