Forem: Peeyush Man Singh

VPN access to USB SMB Server on OpenWRT

Peeyush Man Singh — Fri, 07 Apr 2023 14:36:52 +0000

Introduction

This post deals with accessing an SMB server on a USB mounted to your home router via Tailscale VPN. The purpose is to have a shared folder on your home network which stores files that can be accessed and be modified by devices on your home network, thus reducing dependency on third party cloud storage services. In contrast to cloud storage services, your files stay on your home network and need not be transferred over to a remote third party server. In addition, if you're not connected to your home network, but still require access to the shared files, it is possible to do so by connecting via a VPN to your home network.

This post is divided into three parts: Mounting a USB drive to a OpenWRT router, installing SMB server for file sharing and installing Tailscale as a VPN service.

The prerequisites are: a router running OpenWRT as its operating system, and a USB port should be available on the router. My current setup is running OpenWRT v22.03.3 on a TP-Link Archer A9 AC1900 v6. The SMB (Server Message Block) server will run on Samba4. Alternatively, the SMB server can be installed and run on a Raspberry Pi or a NAS, however they are out of scope of this article as they require additional hardware. Here, the SMB server runs directly on the router itself and stores files on a USB mounted to the router. Tailscale VPN is chosen as a VPN service as my OpenWRT router sits behind a primary router which does not allow port forwarding. Alternatively, if you're running OpenWRT on a primary router, OpenVPN or WireGuard could be used as a VPN server.

Mounting USB drive to OpenWRT

Make sure to have the USB drive formatted to FAT32 format. Then plug it in to the router and create an ssh connection to the router.

$ ssh root@192.168.1.1

To use a USB device with OpenWRT, it needs to be configured with ext4 file system.

$ opkg update
$ opkg install block-mount \
kmod-fs-ext4 e2fsprogs parted \
kmod-usb-storage kmod-usb-uhci \
kmod-usb2 kmod-usb3 \
kmod-usb-core kmod-usb-storage
$ parted -s /dev/sda -- mklabel gpt mkpart extroot 2048s -2048s

We now configure OpenWRT to use the USB to expand its root file system. OpenWRT will split the internal storage into rootfs and rootfs_data partitions, which are merged together into a single writable overlay file system. rootfs is a read only partition mounted on /rom. rootfs_data is a writable partition mounted on /overlay. And overlay is a hybrid of these two file systems mounted on /, where the objects that appear in this file system do not always appear to belong to the same file system. Mostly, an object accessed in this union will be indistinguishable
from accessing the corresponding object from the original file systems.

We now configure the file system tables to mount rootfs_data in another directory in case you need to access the original root overlay to change extroot settings. extroot works by setting another overlay partition in the external storage device, and during boot this new overlay partition will be mounted over the internal storage's overlay partition. This allows easy fallback in case the external storage device is removed, as your device will still have its own overlay partition and thus will load all configuration from there.

$ DEVICE="$(sed -n -e "/\s\/overlay\s.*$/s///p" /etc/mtab)"
$ uci -q delete fstab.rwm
$ uci set fstab.rwm="mount"
$ uci set fstab.rwm.device="${DEVICE}"
$ uci set fstab.rwm.target="/rwm"
$ uci commit fstab

Check block partitions using the following command.

$ block info
/dev/mtdblock8: UUID="9fd43c61-c3f2c38f-13440ce7-53f0d42d" VERSION="4.0" MOUNT="/rom" TYPE="squashfs"
/dev/mtdblock9: MOUNT="/rwm" TYPE="jffs2"
/dev/sda1: UUID="fdacc9f1-0e0e-45ab-acee-9cb9cc8d7d49" LABEL="extroot" VERSION="1.0" MOUNT="/overlay" TYPE="ext4"

The mtdblock* are the devices in internal flash memory, and /dev/sda1 is the partition on the USB flash drive.
We now create an ext4 file system on the first partition of the USB device – /dev/sda1.

$ DEVICE="/dev/sda1"
$ mkfs.ext4 -L extroot ${DEVICE}

Now, we configure the selected partition as new overlay via fstab.

$ eval $(block info ${DEVICE} | grep -o -e "UUID=\S*")
$ uci -q delete fstab.overlay
$ uci set fstab.overlay="mount"
$ uci set fstab.overlay.uuid="${UUID}"
$ uci set fstab.overlay.target="/overlay"
$ uci commit fstab

We now transfer the content of the current overlay to the external drive and reboot the device to apply changes.

$ mount ${DEVICE} /mnt
$ tar -C /overlay -cvf - . | tar -C /mnt -xf -
$ reboot

To test if it worked as expected, after the reboot, login to your Luci web portal and navigate to System -> Mount Points. This should show the USB partition mounted as overlay. And if you navigate to System -> Software, it should show you the additional free space of the overlay partition from the USB drive.

File sharing with Samba4

Install the following dependencies to start a Samba4 server.

$ opkg update
$ opkg install kmod-usb-extras block-mount \
ntfs-3g samba4-server luci-app-samba4

Create a share/ folder. This will be the folder that will be shared on the network. Also, change permissions of the folder so that any user can read and write to the folder.

$ mkdir /overlay/share
$ chmod a+rwX /overlay/share

Now login to Luci web portal and navigate to Services -> Network share and configure as follows.

Interface: lan
Workgroup: WORKGROUP
Enable macOS compatible shares: Check (Optional)

Note: Never expose SMB to the Internet. SMB servers should only be accessed over a VPN.

On the Shared directories section, add a directory with the following configurations.

Name: share
Path: /overlay/share
Browsable: True
Allow guests: True

Save and apply changes. Now we need to add new SMB users. Open /etc/passwd on the router.

$ vi /etc/passwd

Append at the end of file the following line.

newuser:*:1000:65534:newuser:/var:/bin/false

Replace the two newuser placeholders with a username of your choice.

Create password for your newuser.

$ smbpasswd -a newuser

Then restart the Samba4 service.

$ service samba4 restart

Again, login to Luci web portal and navigate to Services -> Network share. On the Shared directories section, on the Allowed Users field, enter the username you selected earlier, uncheck Allow guests, then save and apply.

SMB server is now up and running. You can test this by connecting through another device on the same network. The URL should be smb://192.168.1.1/share (for Windows \\192.168.1.1\share). Then authenticate with the earlier defined username and password.

Install Tailscale on OpenWRT

Install the following dependencies for Tailscale.

$ opkg update
$ okpg install tailscale iptables-nft

Now log in to Tailscale using the following command. Copy the login URL into a browser and use SSO to log in to Tailscale. Then register this router as one of your devices. Also, download and install Tailscale app on a second device, as Tailscale requires at least two devices to be registered to communicate.

$ tailscale up

We need to advertise our local routes for other devices to be able to connect to our local network. You can define the IPv4 address space to be advertised to your devices. Additionally, we can also use this router as an exit node for VPN traffic. If you want split tunneling of your traffic and only require access to the local area network, you can leave out the exit node flag.

$ tailscale up \
--advertise-routes=192.168.0.0/16 \
--advertise-exit-node --accept-routes \
--netfilter-mode=off

Additionally, you need to enable Subnet route and exit node to be allowed on the Tailscale web portal. For this, navigate to the Tailscale web portal. Select Edit route settings on OpenWRT, and enable Subnet routes and Exit node options. Also, you can disable key expiry for OpenWRT router on the web portal so that you need not login time and again via the router.

To use OpenWRT router as an exit node, further configurations should be changed in OpenWRT. Log in to Luci web portal and navigate to Network -> Firewall -> General Settings -> Add and set the following configurations:

General:
    Name: Tailscale
    Input: Accept
    Output: Accept
    Forward: Accept
    Masquerading: True
    MSS clamping: True
    Covered Networks: Unspecified
    Allow forward to destination zones: Lan, Wan
    Allow forward from source zones: Lan, Wan
Advanced:
    Covered devices: tailscale0

Navigate to Network -> Firewall -> NAT Rules -> Add and set the following configurations:

General:
    Name: Tailscale 
    Protocol: Any 
    Outbound zone: Any zone 
    Source address: Any 
    Destination address: Any 
    Action: MASQUERADE
Advanced:
    Outbound device: tailscale0

Tailscale is now configured. Now you should be able to connect to the SMB server via the Tailscale VPN. Tailscale is available as a graphical user app for Windows, Mac, Android, and iOS. To connect to Tailscale from Ubuntu, use the following commands.

$ sudo apt update
$ sudo apt install tailscale
$ #Connect to tailscale and use exit node
$ sudo tailscale up --accept-routes --exit-node=openwrt
$ #Connect to tailscale with split tunneling
$ sudo tailscale up --accept-routes
$ #Disconnect tailscale
$ sudo tailscale down

To start Tailscale automatically on router startup, the Tailscale up command needs to be configured in /etc/init.d.

$ cat > /etc/init.d/tailscalevpn<< EOF
#!/bin/sh /etc/rc.common
# Script to toggle tailscale up and down

START=80

start() {

    tailscale up --advertise-routes=192.168.0.0/16 --advertise-exit-node --accept-routes --netfilter-mode=off

}

stop() {

    tailscale down

}
EOF

The first line of a init.d script must be #!/bin/sh /etc/rc.common. START=80 determines at which point in the init sequence this script gets executed. This means that the file will be symlinked as /etc/rc.d/S80tailscalevpn. It will then start after the init scripts with START=79 and below, but before START=81 and above. The start() command will be run when it is called with 'start' as its parameter (/etc/init.d/tailscalevpn start). Likewise, the stop() command will be run when it is called with 'stop' as its parameter (/etc/init.d/tailscalevpn stop).

Make sure the file is executable.

$ chmod +x /etc/init.d/tailscalevpn

Enable your script. In order to automatically start the init script on boot, it must be enabled. This will create one or more symlinks in /etc/rc.d/ which automatically execute at boot time and shutdown time. This makes the application behave as a system service, by starting when the device boots and stopping at shutdown, as configured in the init.d script. If you need to disable the script, use the disable command.

$ /etc/init.d/tailscalevpn enable

Your script should now have a symlink in /etc/rc.d. At boot time, the init.d daemon just starts executing scripts it finds in /etc/rc.d according to their file names. In this case, our filename will be S80tailscalevpn as described above and will start at the 80th position.

In order to confirm that your script is enabled in init.d, run the following command. If the output of the script is on, it should be enabled.

$ /etc/init.d/tailscalevpn enabled && echo on
on

That is how you can use a USB on a OpenWRT router as a file sharing SMB server and access it via a VPN. Note that SMB is not optimal for streaming media over VPN. It is good for document access over a VPN. However, streaming within the LAN itself is performant. For streaming over VPN, other services such as Plex server should be considered. Apart from SMB, NFS (Network File Share) can also be used to share files on the LAN.

Happy Hacking!

Intrusion Detection using in-built Webcam

Peeyush Man Singh — Fri, 06 Jan 2023 18:13:40 +0000

Introduction

This post is about building an intrusion detection system on Ubuntu using the laptop's in-built camera. It can be used to detect intrusion while you are out of your room or when someone tries to access your computer while it is locked. Also, no additional hardware is required for this setup.

We will be using Motion for motion detection.

Installation

To install Motion on Debian based systems, use the following command.

$ sudo apt-get update
$ sudo apt-get install motion

Optionally, it can also be downloaded via Ubuntu Software Center, and it can be installed on other distros or operating systems by following the installation guide.

Configuring Motion

Copy the root configuration file to your home folder.

$ mkdir ~/.motion
$ sudo cp /etc/motion/motion.conf ~/.motion/motion.conf

Open the configuration file for editing.

$ nano ~/.motion/motion.conf

The daemon option can be changed to on if you want the process to be run in the background.

daemon: off

target_dir specifies the directory location where images and/or videos will be saved to.

target_dir  /home/user/survellience

log_file specifies the file location where the log file will be stored.

log_file /home/user/survellience/log/motion/motion.log

width and height specifies the width and height of images.

width: 640
height: 480

threshold specifies the minimum number of pixels that needs to be changed between frames to trigger an event.

threshold: 500

picture_output specifies whether to save pictures of the event.

picture_output: on

movie_output specifies whether to save a movie clip of the event.

movie_output: on

webcontrol_port specifies the localhost port number where the web portal will be shown.

webcontrol_port 8080

Running motion detection

To run the program, use the following command. The -c option defines the path to the configuration file.

$ motion -c ~/.motion/motion.conf

You can view the web portal on http://localhost:8080/. Also notice image and/or movie files being created in the target_folder when it detects motion.

Sounding the Alarm

To sound an alarm, you will need a mp3 file. Any mp3 file should work. Here is a free alarm mp3 file to download.

To play a mp3 file from the terminal, install the Sox command line utility. libsox-fmt-all is suggested to be installed manually after installing Sox.

$ sudo apt-get update
$ sudo apt-get install sox
$ sudo apt-get install libsox-fmt-all

Create a bash script file in path ~/.motion.

$ touch ~/.motion/event_start_alarm.sh

Then add the following to the contents of the file.

#!/bin/bash
play /home/user/.motion/alarm.mp3

Then make the file executable using chmod.

$ chmod u+x ~/.motion/event_start_alarm.sh

Now open the Motion config file and add the path to this script to the on_event_start option. Note that this option is by default disabled using comment. Make sure to uncomment the line and add the path to the script file.

$ nano ~/.motion/motion.conf

on_event_start /home/user/.motion/event_start_alarm.sh

Now start the program as before and when it detects a motion, it should sound the alarm, take pictures and videos and save them to the target_folder.

$ motion -c ~/.motion/motion.conf

Optionally, the target_folder could also be a network file location, so that you can view what motion the program detected when you are out of home.

You can use the following command if you want Motion to set off after a fixed period of time. For example, if you run the command and go away, it will sound immediately as it detected the motion as you moved away. To avoid this, you can let it start once you leave your workstation, say after 5 minutes of running the command.

$ sleep 5m; motion -c ~/.motion/motion.conf

Motion also continues to work even while your computer is locked, so make sure to lock your computer before leaving.

Happy Hacking!

OpenWRT

Peeyush Man Singh — Fri, 23 Sep 2022 15:57:00 +0000

OpenWRT is a free and open source Linux based operating system for embedded devices such as routers. It is mainly used to increase the router's performance and security as compared to the default firmware that comes pre-installed with the router.

OpenWRT currently supports about 2000 router models. The complete list of routers that support OpenWRT can be found here. Alternatively, with OpenWRT you can also build your own router on an old PC, Raspberry Pi, VM or any hardware that is based on x86 architecture.

Benefits of using OpenWRT

Reduce latency and increase network throughput. OpenWRT reduces Bufferbloat (high latency caused due to excess buffering of packets) using Smart Queue Management(SQM), resulting in consistent latency even under high load.
Increased security. There are no hidden backdoors left by hardware vendors. When security vulnerabilities are found, firmware updates are soon released to fix them. While many commercial vendors only provide updates to the newest hardware models, OpenWRT keeps supporting updates to all routers unless the RAM/Flash storage cannot accommodate the size of the new release.
Less attack vector. The default OpenWRT configuration provides full internet connectivity without exposing the router or any connected devices to attacks.
AdBlock directly on the router. Ads/abuse domains can be blocked directly on the router, thus preventing all connected devices from connecting to those servers. AdBlock need not be installed on individual devices.
Setup a VPN client or VPN server on the router. Setting up a VPN client on the router allows all connected devices to access the internet through a VPN, thus preventing your ISP from snooping on your internet activity. Setting up a VPN server allows you to connect to your home router from a different network when you're away and access resources on the home network, such as shared storage, Network Attached Storage (NAS), Plex server, printer etc.
Secure DNS. OpenWRT supports DNS over HTTPS and allows you to select any DNS server, preventing your ISP from snooping on your DNS requests by using their own DNS server. By using public DNS providers, you can escape DNS-based content filters and internet censorship from your ISP. Encrypted DNS over HTTPS prevents DNS leaks and DNS hijacking. You can force connected devices with hard-coded DNS servers to use your router's DNS to protect DNS traffic.
Create a guest network. You can create a separate wireless network for guests to use. This allows them to access the internet via your router, but blocks them from accessing the devices on your network. Also, you need not share your router's main password with guests.
Prioritize traffic with QOS. OpenWRT allows you to prioritize certain type of traffic or prioritize traffic going to specific devices and deprioritize going to other devices. For instance, you could give the highest priority to video streaming or gaming over web surfing, or give the highest priority to a work computer over mobile devices.
Monitor your network in real time. It allows real time access to all connected devices, and you can log all packets travelling through your router and analyze them using Wireshark.
Time restriction and parental controls. With time restrictions, you can block internet access for certain devices on week days during specific time intervals. Parental control allows you to restrict access to certain web pages.
This is by far not a complete list of all the benefits of OpenWRT. OpenWrt provides more than 3000 packages ready to be installed, unlike vendor firmware that ships with a limited set of capabilities.

Installing OpenWRT

Here is an example for installing OpenWRT on a TP-Link Archer A9 AC 1900 v6 router.

TP-Link Archer A9 AC 1900 v6

Before installing OpenWRT, it is recommended to download the original firmware of your router. For TP-Link users: https://www.tp-link.com/us/support/download/.

Next, download the OpenWRT firmware for the corresponding router and the right version from Table of Hardware by navigating to the corresponding tech data page and downloading files corresponding to "Firmware OpenWrt Install URL" and "Firmware OpenWrt Upgrade URL".

Connect your laptop to the router using an ethernet cable and make sure that the Wi-Fi is turned off on the laptop.

Login to your router's portal. Normally: http://192.168.1.1. Select firmware upgrade option and upload the recently downloaded '...factory.bin' file.

TP-Link portal

Wait for the firmware to be installed.

Once the firmware installation is complete, the browser should be automatically redirected to http://192.168.1.1 OpenWRT portal.

OpenWRT GUI login screen

OpenWRT is now installed.

OpenWRT GUI dashboard

Terminal vs GUI

You can access OpenWRT portal by using the GUI by connecting to http://192.168.1.1. Luci is the graphical user interface for OpenWRT. Alternatively, you can configure OpenWRT from the terminal using ssh.

ssh root@192.168.1.1

OpenWRT in Terminal

Post install

Set password

Set a strong password for OpenWRT portal. Password can be set by navigating to System->Administration.

Set new password

Update OpenWRT firmware

Navigate to System->Flash Firmware and upload the "...sysupgrade.bin" file on the 'Flash new image' field. The router firmware should update to the latest version and reboot.

Update OpenWRT firmware

Enable Wi-Fi

By default, Wi-Fi is disabled on OpenWRT due to security reasons. You can enable it by navigating to Network->Wireless. Dual band routers can have two radios, one for each band that needs to be configured individually.

Enable Wi-Fi on router

Click on edit. Enter the desired Wi-Fi name on ESSID field. Navigate to Wireless Security tab. Choose desired encryption type, cipher, and enter a new password in the 'key' field.

Wi-Fi configuration

Click save and apply.

Wi-Fi should now be available and can be connected using the entered Wi-Fi name and password.

Plugins and add-ons

Adblock: Adblock using plugins adblock and luci-app-adblock.

Adblock in OpenWRT

Encrypted DNS: DNS over HTTPS with plugins dnsmasq and https-dns-proxy. Or DNS over TLS with plugin unbound.

DNS over HTTPS

VPN: OpenVPN client using plugins openvpn-openssl and luci-app-openvpn.

NordVPN on OpenWRT

VPN-Split-tunneling: Enable split tunneling with VPN with plugins vpn-policy-routing and luci-app-vpn-ploicy-routing.

VPN split tunneling, policy-based routing

Statistics: View real time statistics using plugin luci-app-statistics.

Statistics of router

Happy hacking!

2FA with FIDO U2F / OTP / HOTP / TOTP

Peeyush Man Singh — Thu, 16 Sep 2021 12:42:34 +0000

Two-factor authentication (2FA) is an authentication method where the user is granted access only after successfully authenticating oneself via two mechanisms.

Knowledge: something the user knows (eg. password, PIN)
Possession: something the user has (eg. physical key, smartphone)
Inheritance: something the user is (eg. fingerprint, iris scan)

With 2FA, a compromise of one of these factors will not provide access to the account. So, even if your password is stolen or your phone is lost, it is highly unlikely for the attacker to gain access to your account. Generally a combination of username/password and a second authentication factor is used to authenticate the user to the service.

Common 2FA authentication methods include:

Hardware tokens [FIDO U2F / HOTP]
SMS / Voice based [OTP]
Software tokens for 2FA [TOTP]
Biometric (Fingerprint, Retina pattern, facial recognition)
__
OTP - One Time Password
HOTP - Hash based One Time Password
TOTP - Time based One Time Password
FIDO U2F - Fast Identity Online Universal Second Factor

OTP

The user receives an SMS or a voice call with their One Time Password. OTPs are generated with algorithms generating random numbers. It is therefore also resistant to replay attacks since one OTP is only tied to one session. Industry standard algorithms such as SHA-1 generate OTPs with a shared secret and a moving factor.

Many services use SMS OTP as a second form of authentication. It might be more convenient, but is less secure. Sim porting attacks allows an attacker to take over the victim's number to their own device and receive SMS destined to the victim.

HOTP

Similar to OTP, HOTP is generated with a shared secret and the moving factor is based on a counter. Each time HOTP is requested and validated, the counter is incremented. The HOTP generator and the server are synced each time the code is validated. To calculate an OTP, the shared secret and the counter are fed into the HMAC algorithm, which uses SHA-1 as a hash function.

The HOTP code is valid until a new code is generated, which is now seen as a vulnerability. Yubico's Yubikey is an example of OTP generator that uses HOTP.

TOTP

TOTP is used to generate a regularly changing code based on a shared secret and current time. It is similar to HOTP, but the counter is replaced with timestamp values. Each code is generally valid for 30 seconds. If the code is not used in this window, it will become invalid and a new code has to be generated. The server should additionally account for time drifts.

Authenticator apps such as Google Authenticator, Authy, 1Password can be used to generate TOTP.

It is impossible for the attacker to guess the secret keys based on any OTP. OTP, HOTP and TOTP are still susceptible to phishing attacks. If a victim enters the username/password and the OTP into a malicious page, the attacker can quickly use them on the target site, thus gaining control of the user's account.

FIDO U2F

FIDO U2F is an open authentication standard, which allows users to access online services with a physical security key. It works out of the box without any device drivers or software installations. The user also does not have to type in the key unlike OTPs.

When the user first wants to register a key with an account, the security key generates a private key with a random number (nonce) and uses a secure hashing function to hash the nonce, domain of the website that the user is in in and a secret key. FIDO U2F uses HMAC-SHA-256 which is more secure than TOTP hash function (SHA-1). From this private key, a public key is generated with a checksum, also secured by secure hash and sends this to the server along with the nonce. The secret key never leaves the device.

For logging in after registration, the user needs to plug in the key and press the button. The server generates a challenge - a random number and passes this along with the nonce and checksum generated on registration. The security key applies the same process to generate the same private key and uses the checksum to confirm that the nonce did come from the device. The device then signs the challenge with the private key using ECDSA (Elliptic Curve Digital Signature Algorithm) and sends this to the server. The server verifies the signature using the public key.

Yubico Yubikey

Since the domain of the website is used to generate the key, during a phishing attack it will generate a different key and the checksum will fail. So the attacker cannot gain access to the real signature.

It is a hardware security token, so even if the computer is infected with malware, attackers wont be able to steal the secret key in it. The key also requires a human to physically press the button (HID protocol), so it cannot be activated remotely.

Even if an attacker manages to infect the server and steal the public key from the server, they would still not be able to sign the challenge and login. The private key is still stored in the security key. The challenge response mechanism also prevents replay attacks and the signature from the key is also single use.

The same U2F device can be used to authenticate for multiple services. There is no way for anyone to know it was the same device, even if they had access to both databases.

Most keys aren't Bluetooth enabled, so they don't require batteries or maintenance.

If the USB token is lost or stolen, there is no user information that is saved on it. They also can't be cloned, as the private information on the key can't be extracted. So it is impossible for an attacker to determine who it could be used for and on what services. Users can register two U2F devices with every service, so even if one key is lost the other one can be used to unlock the account.

However, the downside is that it costs money to buy a dedicated security key, unlike TOTP, which is free. Also you have to carry around a key and there are chances it might get lost or misplaced, so you need to have an additional key in a secure location, so that you don't get locked out of your account.

Yubico's Yubikey is a popular implementation of FIDO U2F. It works over USB and NFC.

FIDO U2F offers strong security with easy-to-use method, but comes at a cost, although relatively cheap (Yubikeys starting at €45). TOTP also offers good security for free of cost. Password and SMS OTP is still better than password alone. 2FA should be used as an additional security layer and not as to weaken existing ones, such as using weak password or using the same password everywhere.

Happy hacking!

WebSockets bypassing SOP/CORS

Peeyush Man Singh — Sat, 24 Jul 2021 00:16:42 +0000

Same-Origin-Policy (SOP)

Same-Origin-Policy is a mechanism in browsers to protect the users from dynamically loaded document or script. It prevents running malicious scripts in browser to retrieve data from third party services. SOP specifies that dynamic requests can only be sent to URLs with the same Origin as the page they are requested from. Two URLs have the same origin if they share the same protocol, host and port. SOP assures that untrusted sites cannot perform authorized requests with the user's cookies, browser secrets or session identifiers by preventing requests to third parties. It only allows pages to call APIs in its own origin and blocks all other cross-origin requests. By default, modern browsers follow the SOP standards as a security mechanism.

Example: A user visiting https://untrustedsite.com prevents the site from calling https://api.trustedsite.com. The untrusted site pretends to call the trusted site on behalf of the user or without the user's permission. Such requests are blocked by SOP.

Cross-Origin-Resource-Sharing (CORS)

While SOP is an important security measure, it also restricts legitimate cross-origin API calls. CORS relaxes the SOP so that it can be called from a trusted origin that is in a different domain than that of what is currently being called from. CORS policy informs the browser which domains are allowed to access the response object of a request, which HTTP methods are allowed and if cookies should be sent with requests.

The response header Access-Control-Allow-Origin specifies which origins are allowed to access the response objects from cross-origin requests.
The Access-Control-Allow-Credentials specifies if cookies need to be attached. Boolean value.
The Access-Control-Allow-Methods and Access-Contol-Allow-Headers header specifies which methods and headers are allowed.

All requests made from the browser should have a Origin header.

Example: If Access-Control-Allow-Origin: https://trustedclient.com is set on https://api.trustedserver.com. Only the trusted client is able to access the response from the server. Calls from all other origins are blocked by the SOP.

Access-Control-Allow-Origin: * is set to grant resource access to all domains.

Preflight requests

Since Access-Control-Allow-Methods and Access-Contol-Allow-Headers are response headers, there should first be a request made to fetch allowed methods and headers before sending out the actual request. Thus, browsers send a preflight request. The preflight request is an OPTIONS request with the headers Access-Control-Request-Method and Origin. The API then responds with an empty response (HTTP 204) with the appropriate response headers. If the API does not implement CORS then the browser falls back to SOP and the cross-origin request is denied. Requests to resources on the same origin as the requesting site, however, are not preflighted and are also not subjected to SOP. Simple requests are also not preflighted, but do still require CORS headers to be set on response and will restrict access to response data if CORS policy does not allow.

WebSocket protocols (WS/WSS) and Cross-Site WebSocket Hijacking (CSWSH)

Cross-origin restrictions imposed by SOP and CORS policies do not apply to WebSockets because those restrictions are placed on HTTP responses while WebSockets work over WS(WebScoket) or WSS(WebSocketSecure) protocols. To initiate a WebSocket connection, however, the client has to connect to the server over HTTP. Yet, SOP and CORS do not have any effect because no HTTP response data is required to complete WS handshake and data transfer afterwards is completely over the WebSocket protocol WS/WSS. The initial handshake occurs via HTTP Upgrade request, the response body is disregarded and the HTTP/HTTPS protocol is upgraded to WS/WSS protocol. Since CORS only restricts access to response and SOP cannot restrict access on WebSocket protocol, attackers could potentially establish a cross-origin WS connection and send malicious data or receive data from a subscribed channel. If a webserver supports WebSockets, an attacker could create a cross-origin WS connection to the server. Even though the server does not respond with CORS header, WebSocket connection will be established if the server supports WebSockets and sends a 101 Switching Protocol status. From there on, the attacker can simply send and subscribe to data from the server. This is similar to Cross-Site Request Forgery (CSRF) but is extended from write-only CSRF attack to full read/write communication via WebSockets.

Upgrade HTTP to WebSocket

Connection: Upgrade
Upgrade: websocket

The Upgrade header field is used by clients to switch protocols with the server. The server responds with 101 Switching Protocols response and the client-server can begin communicating in the new protocol. WebSockets is the most common use case for upgrading an HTTP connection.

Securing WebSockets

Since SOP and CORS are ineffective for WebSockets, the server implementation should verify the Origin header on the Upgrade request to prevent cross-site WS connections.

const io = require("socket.io")(httpServer, {
  allowRequest: (req, callback) => {
    const isOriginValid = check(req);
    callback(null, isOriginValid);
  }
});

Authentication/authorization should also be performed while establishing connection eg. via token.

As a developer, it is necessary to be aware of this attack and to know how to prevent it.

Happy Hacking!

Docker

Peeyush Man Singh — Wed, 07 Jul 2021 09:36:43 +0000

What is Docker?

Docker is a tool that allows developers to package applications and all their dependencies in a container (sandbox) and deploy and run the application on host operating system (Linux).

What are Containers, Images?

A container is a discrete process that has been isolated from all other processes on the host machine. This is made possible by Kernel Namespaces and Cgroups. This decoupling allows applications to run consistently anywhere isolated from the rest of the applications. Containers run images, which contain everything required to run: application code, runtime environment, dependencies, scripts, etc. Containers run layers of stacked images (eg. a base linux image (mostly alpine due to its compact size), node image and application image on top).

Docker vs VMs

Note that docker containers do not run in their own virtual machines. VMs run on virtual hardware provided by host OS, whereas containers share the host kernel, thus avoiding computation overhead for virtualizing hardware. Also note that Docker requires Linux runtime environment, so running Docker on Windows/Mac requires a single Linux virtual machine that is shared among all the containers run in the system.

Installation

Download and install docker from Docker docs.

Check if installation was successful using

docker version

Docker Hub

Docker hub is the official public repository from docker hosting images of widely used applications.

Pull from docker repository

Pull image from repository (by default Docker hub unless specified otherwise).

docker pull redis

List all images

View all locally available images.

docker images

docker image ls

Run container

Creates a new container from an image, and execute the container. Pulls image from repository (Docker Hub) if container is not found locally. Notice that different layers are pulled separately from the repository. Splitting the layers provides the advantage that if some layers already exist locally, they are skipped from downloading again.

docker run postgres:9.6

docker run docker/whalesay cowsay Hello World!

Run in detached mode. Returns id of the container and starts running the container.

docker run -d postgres:9.6

Re-attach detached container. Requires id of detached container.

docker attach ee8f2eb0b433

docker ps

View all currently running containers.

docker ps

View all running and stopped containers (history). Containers can be restarted using the given container id.

docker ps -a

Stop container

Stops the running container. Requires id/name of container. Returns id/name of stopped container.

docker stop ee8f2eb0b433

Start container

Can be used to restart stopped container. Requires id/name of stopped container. Returns id/name of started container. It does not create a new container, unlike docker run. All configurations are restored which were set while running doc run command.

docker start ee8f2eb0b433

Port Mapping [Host port : Container port]

docker ps displays the port the application is listening inside the container. To connect to this port inside the container, we need the IP the application is running in. Every Docker container gets an IP assigned by default. This is an internal IP and can only be accessed from the host machine. Users outside of the docker host cannot access using this IP. For this, we need to use the IP of the docker host and map a free port from the docker host to the container port. You can also run multiple instances of application and map them to different ports on the host machine.

There should be a binding between the host port and container port. Conflicts will occur if you open two same ports on your host machine. Different containers can however listen on the same port because these two containers are completely isolated of one another.

docker run -p6000:6379 redis

Port 6000 of host machine is binded with port 6379 of container running redis. Redis runs on port 6479. This can be viewed using docker ps.

Display logs

View logs of docker container (eg. while using in detached mode). Requires id/name of running container.

docker logs 777f0e06c4c

docker logs 777f0e06c4c | tail

Custom naming containers

docker run -d --name my-custom-name redis

docker exec

Get the terminal of the running container as a root user. -it stands for interactive terminal. -i maps the standard input of the host to the Docker container. -t stands for pseudo terminal,which displays prompts from the terminal. Requires id/name of container. You can even navigate around the virtual file system, check logs, manage environment, etc.

docker exec -it 777f0e06c4c /bin/sh

docker exec 777f0e06c4c cat /etc/hosts

Docker network

Docker creates it's own isolated network where the containers are running in. When two containers are deployed in the same docker network, they can refer to each other using just the container name because they are in the same network. Applications running outside of docker connect to this network using localhost:port-number.

Display docker networks

Displays all docker networks.

docker network ls

Create new docker network

Creates new docker network

docker network create my-network

Docker run with network option

To run containers in custom docker network, it should be specified in the docker run command.

docker run -d \
-p27017:27017 \ 
-e MONGO_INITDB_ROOT_USERNAME=admin \
-e MONGO_INITDB_ROOT_PASSWORD=password \
--name mongodb \
--net my-network \
mongo

docker run -d \
-p8081:8081 \
-e ME_CONFIG_MONGODB_ADMINUSERNAME=admin \
-e ME_CONFIG_MONGODB_ADMINPASSWORD=password \
--net my-network \
--name mongo-express \
-e ME_CONFIG_MONGODB_SERVER=mongodb \
mongo-express

-e sets the required environment variables.

Docker inspect

View details of a container in JSON format such as mounts, configuration settings, network settings, etc. Requires id/name of container.

docker inspect dreamy_hellman

Docker Compose

With docker compose, docker commands can be mapped to a file, so that configurations are well structured. Note that format of Docker-compose yaml file depends on the version of docker-yaml.

version: '3'
services:
    mongodb:
        image: mongo
        ports:
            - 27017:27017
        environment:
            - MONGO_INITDB_ROOT_USERNAME=admin
            - MONGO_INITDB_ROOT_PASSWORD=password
    mongo-express:
        image: mongo-express
        ports:
            - 8080:8081
        environment:
            - ME_CONFIG_MONGODB_ADMINUSERNAME=admin
            - ME_CONFIG_MONGODB_ADMINPASSWORD=password
            - ME_CONFIG_MONGODB_SERVER=mongodb
        depends_on:
            - mongodb

The network configuration is not included in docker compose. Docker compose will automatically create a common network for all services listed in the docker compose file. Save it as a .yaml file.

Using Docker compose yaml file

Start a container

docker-compose -f my-docker-compose-file.yaml up

Stop a container

docker-compose -f my-docker-compose-file.yaml down

Dockerfile

A dockerfile is a document for building images. Filename must be Dockerfile.

FROM node

ENV MONGO_INITDB_ROOT_USERNAME=admin \
    MONGO_INITDB_ROOT_PASSWORD=password

RUN mkdir -p /home/app

COPY . /home/app

WORKDIR /home/app

CMD ["node","server.js"]

FROM image - build on a base image
ENV - set environment variables
RUN - execute any Linux commands on the container environment
COPY - executes on the host. Copies file from host to the container
WORKDIR - set current working directory so that you don't need to provide full path from /home.
CMD - executes an entry point. There can be multiple RUN commands, but only one CMD command. The command and parameters should be separate entries in the list.

FROM ubuntu

CMD sleep 5

Running docker run sleeper sleep 10, the sleep 10 will overwrite the command specified on CMD. To provide custom arguments, use the ENTRYPOINT command.

FROM ubuntu

ENTRYPOINT ["sleep"]

Running docker run sleeper 10 will append the argument 10 to the list of ENTRYPOINT.

To set a default value for argument, use the combination of both ENTRYPOINT and CMD. Both ENTRYPOINT and CMD should be specified in JSON format.

FROM ubuntu

ENTRYPOINT ["sleep"]

CMD ["5"]

If no arguments is provieded, argument from CMD will be appended to ENTRYPOINT. If arguments are provided, they will be appended to ENTRYPOINT and the values on CMD will be disregarded. You can also overwrite the whole entrypoint command using

docker run --entrypoint somethine-else sleeper 10

Building image from Dockerfile

docker build -t my-app:1.0 .

my-app - image name
1.0 - tag
. - path to Dockerfile

Delete image

Remove image from local host. Requires image id. Image id can be found running docker images. Image can be deleted if all containers built from the image are deleted.

docker rmi e455275b486c

Delete container

Remove container from local host. Requires container id/name. Container id/name can be found running docker ps.

docker rm silly_gagarin

Data persistence using Docker volumes

Data from virtual file system of container is lost when the container is restarted or removed. Docker volumes is used where changes needs to be persisted between restarts. Using Docker volumes, a folder in the physical file system is mounted in the virtual file system of the container. The data is automatically replicated between host file system and virtual file system. Thus, data is persisted even when the container is turned down.

Docker Volume types

Host volumes

Host volumes allows you to determine where on the host file system the data is replicated.

docker run -v /home/mount/data:/var/lib/mysql/data

This is in the form host-file-system-path:virtual-file-system-path.

Anonymous Volumes

Only path in the virtual file system is provided. Docker automatically maintains where in the host file system the replica should reside. For each container, a folder is generated in the host file system path /var/lib/docker/volumes/{hash}/_data.

docker run -v /var/lib/mysql/data

Named Volumes

This is similar to anonymous volumes, but you can specify the name of the folder on the host file system. This type of volume can be referenced simply using the name, so you don't have to know the path.

docker run -v name:/var/lib/mysql/data

Volumes in docker-compose

version: '3'
services:
    mongodb:
        image: mongo
        ports:
            - 27017:27017
        environment:
            - MONGO_INITDB_ROOT_USERNAME=admin
            - MONGO_INITDB_ROOT_PASSWORD=password
        volumes:
            - my-volume:/data/db
    mongo-express:
        image: mongo-express
        ports:
            - 8080:8080
        environment:
            - ME_CONFIG_MONGODB_ADMINUSERNAME=admin
            - ME_CONFIG_MONGODB_ADMINPASSWORD=password
            - ME_CONFIG_MONGODB_SERVER=mongodb
volumes:
    my-volume:
        driver: local

Note that here we have used named volumes. Also note that we can mount the reference of the same folder on the host file system to more than one container, for example if the containers need to share the same data.

Container Orchestration

Container orchestration contains of multiple docker hosts that can host containers, so that if one fails, the application is still available through the others. Some orchestration solutions can help automatically scale up the number of container instances when users increase and scale down when the demand decreases. They also help in load balancing requests across hosts. Some container orchestration solutions are docker swarm, kubernetes and mesos.

Happy Hacking!

Safe Navigation Operator? Bang! Bang Bang!!

Peeyush Man Singh — Fri, 12 Mar 2021 18:51:31 +0000

Safe Navigation Operator

Safe navigation operator or optional chaining is now available in JavaScript and TypeScript >= v3.7🎉.

It provides easy access to deeply nested values, so checking for nullish (undefined or null) values is simplified. We avoid hitting the classic JavaScript error:

Uncaught TypeError: Cannot read property 'foo' of undefined.

A common workaround would be to short-circuit using the && operator. However, this would quickly unwind to long repetitive chains if we need to check for a deeply nested object.

const foo = a && a.b && a.b.c && a.b.c.d && a.b.c.d[0];

A lodash solution might look like

const foo = _.has(a, 'b.c.d[0]');

The safe navigation operator approach looks like

const foo = a?.b?.c?.d[0];

Returns undefined if the value does not exist.

This approach is recommended since it has now been added to the language and is browser supported. //! Except Internet Explorer

This also works with function calls, array indexes and chaining dynamic expressions.

const foo = a?.b //accessing object property
const foo = a?.[expr] //accessing through dynamic expression
const foo = arr?.[index] //accessing array index
const foo = bar?.(args) //conditional function call

Warning: This operator is not valid on the left-hand-side of an assignment operator.

const a?.b = foo; //Invalid

Note: ?. acts differently than && operator, since the && operator acts on falsy values(including 0, NaN, "", false), but ?. acts on nullish values (null and undefined).

TypeScript Bang! (non-null assertion operator)

Warning: !. is not the same as ?. . The ! postfix expression is valid in TypeScript >= v2.0. The a! operator produces a value a with null and undefined excluded. Meaning, this will explicitly tell the compiler that you are sure the type of value is not null or undefined. The compiler will thus not check if the value is null or undefined in compile time.

This could come in handy while working with maps.

const value = map.has('key') && map.get('key')!;

In this case, the compiler does not keep track that map.has() has been evaluated while evaluating map.get(). So the compiler can't determine if the map returns a safe value.

This can also be used in terms of calling a possibly undefined function and array indexes.

func!(args);
arr![0];

For example it could be used when using React refs. When using refs, the current value may be null if the element is unmounted.

JavaScript Bang! (prefix operator)

In JavaScript every value is assocaiated as either a truthy value or a falsy value. So, a bang(!) as a prefix on a value acts as a logical "not" operator on that value.

!true; //returns false
!false; //returns true

!1 //returns false
!5 //returns false

!0 //returns true
!NaN //returns true
!null //returns true
!undefined //returns true

![] //returns false (points to a reference)

const foo = "bar";
!foo //returns false

const baz = null;
!baz //returns true

JavaScript Bang Bang!!

Since a bang (!) acts as a logical "not" on a value, a double bang negates the result of the logical "not" operation. So, a double bang will first change the value to a boolean opposite, and return the opposite of that. In other words, it converts any value into a boolean type.

Note: The ! operator operates on truthy and falsy values and is not limited to nullish values. So, !'' should resolve to true.

!!true //returns true
!!false //returns false

!!null //returns false
!!undefined //returns false
!!NaN //returns false

!!34 //returns true
!!0 //returns false

!!'foo' //returns true
!!'' //returns false

!!['foo'] //returns true
!![] //returns true (points to a reference)

!!{foo: 'bar'} //returns true
!!{} //returns true (points to a reference)

Happy Hacking!

PWA Caching Strategies

Peeyush Man Singh — Sun, 27 Dec 2020 21:54:56 +0000

Caching strategies determine how a PWA behaves when the app makes a network request and how it deals with network failures. Workbox is a commonly used library for creating PWA; workbox-strategies provides the following caching strategies.

Stale-While-Revalidate

The service worker will serve the cached assets first, and update the cache with the latest version afterwards. On cache-hit, it responds to the request as quickly as possible. On cache-miss, the request falls back to network request. The response from network request is then used to update the cache. This strategy is useful in situation where receiving a response has higher priority over having most up-to-date results.

Cache First

The service worker will serve the cached assets and will only query the network if the cache is not available. On cache-hit, it will not update the cache in background; the network will not be used at all. On cache-miss, the request will be sent over the network and the response will be cached. The next request will then be served from the cache. This strategy is useful for requests for static assets, which do not change frequently.

If no caching strategy is defined, Workbox will use Cache First as default.

Network First

The service worker will by default try to fetch the response over the network. If the network request fails, it will serve the response from the cache. On successful response over the network, it will cache the response for future use. This strategy can be useful in requests that update frequently.

Network Only

The service worker will always query the network for response. This can be useful if you require to query the network strictly.

Cache only

The service worker will always query the cache for response. You need to make sure that you pre-cache resources before requesting. This strategy is less used in practice.

Example Usage

On your service-worker.ts, add a custom strategy for a fetch event.
Note: You could also define custom events for different fetch requests by filtering depending on URL origin or path.

import { StaleWhileRevalidate } from "workbox-strategies";

...

//! Stale-While-Revalidate for all fetch events
self.addEventListener("fetch", (event) => {
    const { request } = event;

    event.respondWith(new StaleWhileRevalidate().handle({ event, request }));
});

Workbox also allows you to define custom strategies. All of these strategies also allow you to configure name of cache, cache expiration and an array of additional workbox plugins.

Happy Hacking!

PWA Metadata in manifest.json

Peeyush Man Singh — Fri, 25 Dec 2020 19:30:25 +0000

Every PWA should have a manifest file, a JSON file specifying metadata of the app. Manifest.json is required to add PWA to the homescreen. It defines how the app should look like and configures the app's behavior on launch.

You can find the manifest.json file in public/ directory.

It should be linked in public/index.html by default.

<link rel="manifest" href="%PUBLIC_URL%/manifest.json" />

Details on manifest.json config

short_name

Name of your app on home screen.

name

Name of app used on prompt while installing. If not present, short_name will be used.

icons

It is an array of image objects that is displayed in the home screen. Each of the object in the array must have properties src, sizes and type. You may need to add additional property "purpose": "any maskable" for android devices. For Chrome, you need to provide icons of size 192x192 and 512x512 for auto scaling of icons. They are provided by default while creating PWA with create-react-app.

start_url

The home URL of page, so that it does not start from the page the user used to add the app to home screen. By default, it is set to .(home directory). You may modify it according to your needs.

display

It customizes the browser view for your app. It can take the following values:

fullscreen: Open the app in full screen. Browser UI such as address bar and navigation are hidden. Android status bar is also hidden.
standalone: The app runs in its own window, separate from the browser. Browser UI elements like address bar and navigation are hidden. Android status bar is not hidden.
minimal-ui: It is similar to the standalone mode, but minimal set of UI elements for controlling navigation are displayed. However, the UI elements may differ from browser to browser.
browser: Standard browser behavior. All browser UI are displayed. However, "Add to Home screen" is not displayed.

theme_color

Sets the color of browser toolbar. It also displays this color in browser tabs while tab switching.

background_color

Color to be displayed in splash screen when the app is first launched.

scope

Defines the scope of PWA. If the user navigates out of scope, the page will be served as a normal site. The start_url should be inside of scope. If the user clicks on a link outside of the scope, it will be rendered in the PWA. To open a outside link on a browser window, add target="_blank" to the anchor tag.
If the scope is a relative path, the base location will be where the manifest file is located.

Testing manifest.json

To test if your manifest.json is setup correctly, use the Chrome dev tools. In application section, navigate to Manifest subsection.

Happy Hacking!

PWA with create-react-app

Peeyush Man Singh — Thu, 24 Dec 2020 22:35:02 +0000

Setting up PWA with create-react-app and typescript.

Install create-react-app if you haven't already.

npm i create-react-app -g

Create a react app with TypeScript and PWA support. Also, we are using NPM as package manager. Alternatively, you may use yarn.

create-react-app frontend --use-npm --template cra-template-pwa-typescript

To build the project run:

npm run build

To run the build folder, we are using http-server. You may use any server.

Install http-server if you haven't already.

npm i http-server -D

Add script scripts section of package.json file:

"scripts": {
    ...
    "start-sw": "http-server ./build"
}

To run the script, run:

npm run start-sw

Go to the browser and type the url with the associated port number.

To check the status of service workers, open chrome dev tools. Under the application section, go to "service workers" subsection.
If no service workers are registered, you need to enable them in the code.

Navigate to index.tsx and change serviceWorkerRegistration.unregister(); to serviceWorkerRegistration.register();

Rebuild the project and restart the server.

npm run build && npm run start-sw

Now you should see registered service workers.

You may also try stopping the server and reloading the site, or use chrome dev tools on Application section to simulate offline mode. Check the Offline checkbox on the Service workers section.

The site should reload without displaying a "No internet" error message.

Happy Hacking!

Internationalization using React-i18next legacy version (v9)

Peeyush Man Singh — Fri, 10 Jul 2020 14:09:59 +0000

What is i18next?

i18next is a popular framework for internationalization. React-i18next is the version of i18next for React applications.

Why legacy version React-i18next?

To use the latest version of React-i18next, the requirements are:

react >= v16.8.0
react-dom >= v16.8.0
react-native >= v0.59.0
i18next >= v10.0.0(typescript users: >= v17.0.9)

Requirements for React-i18next v9

react >= v0.14.0
i18next >= v2.0.0

Installation

npm install react-i18next@legacy i18next --save
npm install i18next-browser-languagedetector --save
npm install i18next-xhr-backend --save
npm install i18next --save

For TypeScript users, install the type definitions manually.

Warning: Type definitions for i18next-xhr-backend and i18next-browser-languagedetector are deprecated.

npm install @types/i18next-xhr-backend --save
npm install @types/i18next-browser-languagedetector --save

Folder structure

i18n-project/
├── src/
│   ├── components/
│   │   ├── component1/
│   │   │   ├── locales/
│   │   │   │   ├── default.de.json
│   │   │   │   └── default.en.json
│   │   │   └── Component1.tsx
│   │   ├── component2/
│   │   │   ├── locales/
│   │   │   │   ├── default.de.json
│   │   │   │   └── default.en.json
│   │   │   └── Component2.tsx
│   │   └── App.tsx
│   ├── i18n/
│   │   ├── locales/
│   │   │   ├── default.de.json
│   │   │   ├── default.en.json
│   │   │   └── index.tsx
│   │   └── index.tsx
│   ├── types/
│   │   └── module.d.ts
│   └── index.tsx
│
├── package.json
└── tsconfig.json

Configure TypeScript to import JSON files

i18n-project/src/types/module.d.ts

declare module "*.json"{
    const value: any;
    export default value;
}

i18n-project/tsconfig.json

{
    "compilerOptions":{
        ...
        "resolveJsonModule": true
    }
}

Initialize main translation files

All other translation files are later concatenated onto the main translation file as we will see later.

i18n-project/src/i18n/locales/default.de.json

{
    "de": {}
}

i18n-project/src/i18n/locales/default.en.json

{
    "en": {}
}

i18next Configuration file

i18n-project/src/i18n/index.tsx

import i18n from "i18next";
import * as detector from "i18next-browser-languagedetector";
import * as Backend from "i18next-xhr-backend";
import { de, en } from "./locales";

i18n.use(Backend)
    .use(detector) //Browser Language Detector
    .init({
        interpolation: {
            escapeValue: false
        },

        debug: true,

        resources: {
            de: {
                common: de.de
            },
            en: {
                common: en.en
            }
        },

        fallbackLng: "en", //Fallback Language: English

        ns: ["common"],

        defaultNS: "common",

        react: {
            wait: false,
            bindI18n: "languageChanged loaded",
            bindStore: "added removed",
            nsMode: "default"
        }
    });
export default i18n;

Setup provider in App

i18n-project/src/index.tsx

import * as React from "react";
import * as ReactDOM from "react-dom";
import { Provider } from "react-redux";
import { I18nextProvider } from "react-i18next";
import i18n from "./i18n";

ReactDOM.render(
    <I18nextProvider i18n={i18n}>
        <Provider store={store}>
            ...
        </Provider>
    </I18nextProvider>,
    document.getElementById("root")
);

Configure local translation files for each component

i18n-project/src/components/component1/locales/default.de.json

{
    "de": {
        "header": "Willkommen in Comp1",
        "body": "Comp1 ist auf Deutsch.",
        "...": "..."
    }
}

i18n-project/src/components/component1/locales/default.en.json

{
    "en": {
        "header": "Welcome in Comp1",
        "body": "Comp1 is in English.",
        "...": "..."
    }
}

i18n-project/src/components/component2/locales/default.de.json

{
    "de": {
        "header": "Willkommen in Comp2",
        "link": "Comp2 ist auf <1>Deutsch</1>.",
        "...": "..."
    }
}

i18n-project/src/components/component2/locales/default.en.json

{
    "en": {
        "header": "Welcome in Comp2",
        "link": "Comp2 is in <1>English</1>.",
        "...": "..."
    }
}

Notice we used <1>...</1> tags to feature Trans component. To learn more about the numbering, checkout this fantastic resource:
https://github.com/arkross/arkross.github.io/wiki/Using-react-i18next-Trans-Component

Change constants from each component to load from i18n

i18n-project/src/components/component1/Component1.tsx

import * as React from "react";
import i18n from "./../../i18n";

export class Component1 extends React.PureComponent<..., ...> {
    render() {
        return(
            <h1>{i18n.t("Component1.header")}</h1>
            <p>{i18n.t("Component1.body")}</p>
        );
    }
}

i18n-project/src/components/component2/Component2.tsx

import * as React from "react";
import i18n from "./../../i18n";
import { Trans } from "react-i18next";

export class Component2 extends React.PureComponent<..., ...> {
    render() {
        return(
            <h1>{i18n.t("Component2.header")}</h1>
            <Trans i18nKey="Component2.link" i18n={i18n}>
                Comp2 is in <a href="..." >English</a>.
            </Trans>
        );
    }
}

Notice we used <a>...</a> tags in place of <1>...</1>.

Combine all translation files onto main translation file

i18n-project/src/i18n/locales/index.tsx

let de: any = require("./default.de.json");
let en: any = require("./default.en.json");

import * as Component1De from "./../../components/component1/locales/default.de.json";
import * as Component1En from "./../../components/component1/locales/default.en.json";

import * as Component2De from "./../../components/component2/locales/default.de.json";
import * as Component2En from "./../../components/component2/locales/default.en.json";

...

de["de"].Component1 = Component1["de"];
en["en"].Component1 = Component1["en"];

de["de"].Component2 = Component2["de"];
en["en"].Component2 = Component2["en"];

...

export { de, en };

Language Change feature (optional)

i18next-project/src/components/component-of-your-choice

import * as React from "react";
import i18n from "./../i18n";

interface ChangeLngState{
    language: string;
}

export class ChangeLng extends React.Component<..., ChangeLngState> {
    state = {
        language: i18n.language
    };

    render(){
        return(
            <div>
                <Input
                    type="select"
                    name="language"
                    id="language"
                    onChange={this.languageChanged.bind(this)}
                    defaultValue={this.getDefaultValue()}
                >
                    <option>Deutsch<option>
                    <option>English<option>
                </Input>
                <Button onClick={this.onApply.bind(this)}>
                    Apply
                </Button>
            </div>
        );
    }

    languageChanged(event: any) {
        if (event.target.value === "Deutsch") {
            this.setState({
                language: "de"
            });
        } else {
            this.setState({
                language: "en"
            });
        }
    }

    getDefaultValue() {
        if (i18n.language === "de") {
            return "Deutsch";
        } else {
            return "English";
        }
    }

    onApply() {
        if (i18n.language != this.state.language) {
            i18n.changeLanguage(this.state.language, () => {
                location.reload();
            });
        }
    }
}

Bonus: Change title according to language

i18next-project/src/components/App.tsx

import * as React from "react";
import i18n from "./../i18n";
...

export class App extends React.Component<...> {
    componentDidMount(): void {
        if (i18n.language == "de") {
            document.title = "Titel auf Deutsch";
        } else {
            document.title = "Title in English";
        }
    }
}

Advantages of using this approach

Translations can be split into multiple files for multiple languages.
Translation files are split for every component inside the component folder.
Automatic browser default language detection.
Change language with ease.

Drawbacks of the approach

React version must be greater than 16.8.0 to use latest version of i18next.
Splitted translations should be combined in a main translation file.
Translation keys must match exactly for translation to work.
All translation keys must exist on fallback language.

References:

Official documentation for React-i18next legacy version: https://react.i18next.com/legacy-v9/step-by-step-guide
Language codes can be found in: https://www.w3.org/International/O-charset-lang.html
https://medium.com/rd-shipit/internationalizing-a-front-end-application-88f1baae3d82

Github: https://github.com/pssingh21
#first_post😉