bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 06:47:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Reject extra session token segments (#18)

Browse source
This commit is contained in:
Autowebassat-blip 2026-06-12 06:04:25 +02:00 • committed by GitHub
parent aa7eb32c36
commit d558554da3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apps/logicsrc-web/contract/logicsrc-web.contract.test.ts
View file

@ -376,7 +376,8 @@ describe("session signing", () => {
process.env.LOGICSRC_SESSION_SECRET = "session_secret_for_tests";
const token = signSession({ provider: "coinpay", sub: "merchant-123" });
expect(verifySession(token)).toMatchObject({ provider: "coinpay", sub: "merchant-123" });
expect(verifySession(`${token}tampered`)).toBeNull();
expect(verifySession(`tampered`)).toBeNull();
expect(verifySession(`.extra`)).toBeNull();
});
});

4
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -160,7 +160,9 @@ export function signSession(payload: Record<string, unknown>): string {
}
export function verifySession(value: string): Record<string, unknown> | null {
const [encoded, signature] = value.split(".");
const parts = value.split(".");
if (parts.length !== 2) return null;
const [encoded, signature] = parts;
if (!encoded || !signature) return null;
const expected = createHmac("sha256", getSessionSecret()).update(encoded).digest("base64url");