bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 23:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(auth): use base64url encoding in session signature verification (fixes #64)

Browse source
This commit is contained in:
FuturMix 2026-06-14 12:20:33 +08:00
parent 8f4691584c
commit c557ec8dd5
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -166,8 +166,8 @@ export function verifySession(value: string): Record<string, unknown> | null {
if (!encoded || !signature) return null;
const expected = createHmac("sha256", getSessionSecret()).update(encoded).digest("base64url");
const actualBuffer = Buffer.from(signature);
const expectedBuffer = Buffer.from(expected);
const actualBuffer = Buffer.from(signature, "base64url");
const expectedBuffer = Buffer.from(expected, "base64url");
if (actualBuffer.length !== expectedBuffer.length || !timingSafeEqual(actualBuffer, expectedBuffer)) {
return null;
}