bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 14:37:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject extra session token segments (#18)

Browse source
This commit is contained in:
Autowebassat-blip 2026-06-12 06:04:25 +02:00 • committed by GitHub
parent aa7eb32c36
commit d558554da3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apps/logicsrc-web/contract/logicsrc-web.contract.test.ts
View file

@ -376,7 +376,8 @@ describe("session signing", () => {
process.env.LOGICSRC_SESSION_SECRET = "session_secret_for_tests";
const token = signSession({ provider: "coinpay", sub: "merchant-123" });
expect(verifySession(token)).toMatchObject({ provider: "coinpay", sub: "merchant-123" });
expect(verifySession(`${token}tampered`)).toBeNull();
expect(verifySession(`tampered`)).toBeNull();
expect(verifySession(`.extra`)).toBeNull();
});
});