From fbf45404d5810def49b47609cb2a70a09374bc58 Mon Sep 17 00:00:00 2001
From: Jannis R <mail@jannisr.de>
Date: Sun, 3 May 2020 01:36:16 +0200
Subject: TOFU client certificates, part 1

---
 examples/client.js | 22 ++++++++++++++++++++++
 examples/server.js |  6 ++++++
 2 files changed, 28 insertions(+)

(limited to 'examples')

diff --git a/examples/client.js b/examples/client.js
index 49e38d0..737b381 100644
--- a/examples/client.js
+++ b/examples/client.js
@@ -1,7 +1,28 @@
 'use strict'
 
+const {createInterface} = require('readline')
 const {request} = require('..')
 
+// https://gemini.circumlunar.space/docs/spec-spec.txt, 1.4.3
+// > Interactive clients for human users MUST inform users that such a session
+// > has been requested and require the user to approve generation of such a
+// > certificate. Transient certificates MUST NOT be generated automatically.
+const letUserConfirmClientCertUsage = ({host, reason}, cb) => {
+	const prompt = createInterface({
+		input: process.stdin,
+		output: process.stdout,
+		history: 0,
+	})
+	prompt.question([
+		`Send client cert to ${host}?`,
+		reason ? ` Server says: "${reason}".` : '',
+		' y/n > '
+	].join(''), (confirmed) => {
+		prompt.close()
+		cb(confirmed === 'y' || confirmed === 'Y')
+	})
+}
+
 const onError = (err) => {
 	console.error(err)
 	process.exit(1)
@@ -9,6 +30,7 @@ const onError = (err) => {
 
 request('/bar', {
 	followRedirects: true,
+	useClientCerts: true, letUserConfirmClientCertUsage,
 	tlsOpt: {
 		rejectUnauthorized: false,
 	},
diff --git a/examples/server.js b/examples/server.js
index 2012c42..d9eb587 100644
--- a/examples/server.js
+++ b/examples/server.js
@@ -7,7 +7,13 @@ const {
 } = require('..')
 
 const onRequest = (req, res) => {
+	console.log('request', req.url)
+	if (req.clientFingerprint) console.log('client fingerprint:', req.clientFingerprint)
+
 	if (req.path === '/foo') {
+		if (!req.clientFingerprint) {
+			return res.requestTransientClientCert('/foo is secret!')
+		}
 		res.write('foo')
 		res.end('!')
 	} else if (req.path === '/bar') {
-- 
cgit v1.3