bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 14:37:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(auth): use base64url encoding in session signature verification (fixes #64) (#67)

Browse source
This commit is contained in:
FuturMix 2026-06-14 13:44:53 +08:00 • committed by GitHub
parent df040f4ff0
commit 5cfece3b84
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -166,8 +166,8 @@ export function verifySession(value: string): Record<string, unknown> | null {
if (!encoded || !signature) return null;
const expected = createHmac("sha256", getSessionSecret()).update(encoded).digest("base64url");
const actualBuffer = Buffer.from(signature);
const expectedBuffer = Buffer.from(expected);
const actualBuffer = Buffer.from(signature, "base64url");
const expectedBuffer = Buffer.from(expected, "base64url");
if (actualBuffer.length !== expectedBuffer.length || !timingSafeEqual(actualBuffer, expectedBuffer)) {
return null;
}