Authentication Bypassed

[Foreeps]

Since SparkyBudget doesn't have multi-user support, I created two instances for two people. The users have different names, passwords, and ports, but logging into one also lets me access the other one. Likewise, if I log out of one I get logged out of the other, but the credentials don't work on the other instance. It looks like the authentication tokens are just generic.

Thank you!

[CodeWithCJ]

Hi @Foreeps ,
I and my spouse share the same credentials as we we share all our accounts. I didn't setup the App to work with muti user. But I can definitely look into it if you are looking for feature. I was also thinking to introduce RSL but it would require changing from SQLite to Postgre or some other DB where we can keep our own accounts , Transactions, budgets and as well as share limited accounts to other users. But I never implemented as it wasn't required in my case.

Multi-user support would require enhancement. Currently I am occupied with my another project SparkyFitness, once its stable, I will look into this.

https://github.com/CodeWithCJ/SparkyFitness

Tip: Use "add to home screen" to bookmark the app in your phone. This will create a icon similar to other apps facebook, instagram etc. outside your browser directly in the homescreen. SparkyBudget will open in full screen giving you native app like experience. I tested in iOS alone.

[CodeWithCJ]

@Foreeps when you mentioned "two instances" , did you mean two different docker containers? Could you provide more details on this.

[Foreeps]

I don't have a problem with SparkyBudget not supporting multiple users - that seems like a lot of work! I don't even need it fixed for myself: my accounts are completely independent of my wife's and vice-versa, but they aren't private in any way. Having a password at all is not important for my use-case. I'm just concerned that whatever cookie gets set in the browser to confirm I've logged in correctly isn't specific to the server and seems to unlock any server, which seems like a really big hole for anyone who comes along and tries relying on the password for privacy.

In my case, both copies of SparkyBudget are running on the same hardware and have the same IP address but different ports - would this bug also expose someone's SparkyBudget on a different computer on my network? Could I log in to my copy, take my laptop across town to someone else's house, put their server's address into my browser and get full access to their data? If I found someone who exposed their copy to the Internet, could I get into all their financials just by logging into my own copy first? (I'm just guessing what the problem is - I'm not an expert by any means, and I haven't tested these hypotheticals.)

I'm new to Docker, and to Linux, so I don't know all the right terms, but I'll describe what I'm doing the best I can. I have a TrueNAS server that I've started to add various apps to. It has a Docker-based app market for a lot of apps with customized guided setup and varying levels of official support, a "Custom App" option that tries to provide a generic guided setup for you to tell it the images, containers, environmental variables, storage volumes you want, and so on, and then an "Install via YAML" option. The guided setup for the "Custom App" option uses a lot of jargon I don't know, with very brief tooltips and documentation, and which never matches my target app's installation instructions, so it just confuses me. But after a lot of trial and error and experimentation, I've gotten pretty good at installing via YAML.

So I created two apps, sparkybudget1 and sparkybudget2. Each has their own YAML describing their own containers and environment variables, and each has their own separate storage volume mapped to them ("volumes: - /mnt/.ix-apps/app_mounts/sparkybudget1/private:/private:rw" and "volumes: - /mnt/.ix-apps/app_mounts/sparkybudget2/private:/private:rw"). They have different values for SPARKY_USER and SPARKY_PASS. I gave the first one port 5051 ("ports: - '5051:5000'") and the second 5052 ("ports: - '5052:5000'"), so going to http://server:5051 goes to one of them, while http://server:5052 goes to the other. As far as I know, they should be completely isolated from each other, but if I go to http://server:5051 and log in, then go to http://server:5052, I'm taken directly to the main dashboard. If I then click on "Logout," go back to the tab for http://server:5051 and refresh, I'm redirected back to the login screen. The username/password for sparkybudget1 don't work on sparkybudget2, and vice-versa, but the login state carries over.

Again, I don't need this fixed, it doesn't affect me in any way, it just seems wrong. Once I realized what was happening I just wanted to make sure you knew about it, so you could decide whether to fix it, or document it as insecure, or whatever you want to do.

Incidentally, thank you for putting this out there! It's really slick and polished, and I like it a lot! I've been using Quicken for more than 20 years - I stayed on Quicken 2012 until they did something that made it stop loading, then moved to Quicken 2015. A while back they did something that makes 2015 only load every 4th time you launch it - somehow the check-for-update link being bad makes the whole program refuse to run - but now every version of every corporate finance program I can find is all cloud, all the time, no disabling, no local storage, no privacy, trust us, we won't let anyone steal all your financial data, well, we won't let anyone steal all your financial data again anyways, and we definitely won't misuse it ourselves, but because you get all these great cloud features now you need to pay us every month instead of just buying the software once. It wasn't until I started playing around with this home lab stuff that I found any private options for finance management at all, and SparkyBudget has been great. My wife had been getting extremely frustrated with the state of things!

[CodeWithCJ]

I haven't tested yet. But at high level below env variable could be the culprit. I missed to update this in the example env file.

When you don't provide the key, it assigns to default value "your-very-secure-key" in my code causing weird behavior. Try updating this env variable and let me know if it resolves the issue. I will roll out a fix later today once you confirm

FLASK_SECRET_KEY=Your_Secret_Key_preferably_long_and_random

#app.secret_key = secrets.token_hex(16)
app.secret_key = os.getenv("FLASK_SECRET_KEY", "your-very-secure-key")

Looking at the above code, looks like I had hex code previously and for some reason, I made it to be env variable. I couldn't re-collect why, but could be something to do with session not retaining correctly.

[Foreeps]

Looks like that fixed it - although now, if I log into one instance and then log into the other I become logged out of the first one. But that isn't a big deal.

Thank you!

[CodeWithCJ]

Did you use two different secrets for your instances? I'm going to configure two containers in my server to reproduce the issue..

[Foreeps]

Yes, two different secrets, generated from https://it-tools.tech/token-generator?length=64