Skip to content

chore(shared): remove the legacy IP HMAC lookup from security events #21025

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vbudhram merged 1 commit into from
Aug 14, 2026
Merged

chore(shared): remove the legacy IP HMAC lookup from security events #21025

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 4 additions & 26 deletions packages/fxa-shared/db/models/auth/security-event.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,26 +105,6 @@ function ipHmac(key: Buffer, uid: Buffer, addr: string) {

return hmac.digest();
}
/**
* This is used during lookups only to match records written before we
* stopped prefixing ipv4 addresses; FXA-13433.
*
* After some amount of time, we will have more recent login records with the new HMAC than
* the old, and we can remove this legacy HMAC function and the associated tests.
*
* Cleanup ticket: https://mozilla-hub.atlassian.net/browse/FXA-13667
*/
function ipHmacLegacy(key: Buffer, uid: Buffer, addr: string) {
addr = sanitizeIp(addr);
if (ip.isV4Format(addr)) {
addr = '::' + addr;
}
const hmac = crypto.createHmac('sha256', key);
hmac.update(uid);
hmac.update(ip.toBuffer(addr));

return hmac.digest();
}

export class SecurityEvent extends BaseAuthModel {
public static tableName = 'securityEvents';
Expand Down Expand Up @@ -203,8 +183,7 @@ export class SecurityEvent extends BaseAuthModel {

static async findByUidAndIP(uid: string, ipAddr: string, ipHmacKey: string) {
const id = uuidTransformer.to(uid);
const key = Buffer.from(ipHmacKey);
const hmacs = [ipHmac(key, id, ipAddr), ipHmacLegacy(key, id, ipAddr)];
const hmac = ipHmac(Buffer.from(ipHmacKey), id, ipAddr);
return SecurityEvent.query()
.select(
'securityEventNames.name as name',
Expand All @@ -219,7 +198,7 @@ export class SecurityEvent extends BaseAuthModel {
'securityEventNames.id'
)
.where('securityEvents.uid', id)
.whereIn('securityEvents.ipAddrHmac', hmacs)
.andWhere('securityEvents.ipAddrHmac', hmac)
.orderBy('securityEvents.createdAt', 'DESC')
.limit(20);
}
Expand All @@ -230,8 +209,7 @@ export class SecurityEvent extends BaseAuthModel {
ipHmacKey: string
) {
const id = uuidTransformer.to(uid);
const key = Buffer.from(ipHmacKey);
const hmacs = [ipHmac(key, id, ipAddr), ipHmacLegacy(key, id, ipAddr)];
const hmac = ipHmac(Buffer.from(ipHmacKey), id, ipAddr);
return SecurityEvent.query()
.select(
'securityEventNames.name as name',
Expand All @@ -248,7 +226,7 @@ export class SecurityEvent extends BaseAuthModel {
.where('securityEvents.uid', id)
.where('securityEvents.verified', 1)
.where('securityEvents.nameId', EVENT_NAMES['account.login'])
.whereIn('securityEvents.ipAddrHmac', hmacs)
.andWhere('securityEvents.ipAddrHmac', hmac)
.orderBy('securityEvents.createdAt', 'DESC')
.limit(20);
}
Expand Down
Loading