bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 22:37:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject extra session token segments (#18)

Browse source
This commit is contained in:
Autowebassat-blip 2026-06-12 06:04:25 +02:00 • committed by GitHub
parent aa7eb32c36
commit d558554da3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -160,7 +160,9 @@ export function signSession(payload: Record<string, unknown>): string {
}
export function verifySession(value: string): Record<string, unknown> | null {
const [encoded, signature] = value.split(".");
const parts = value.split(".");
if (parts.length !== 2) return null;
const [encoded, signature] = parts;
if (!encoded || !signature) return null;
const expected = createHmac("sha256", getSessionSecret()).update(encoded).digest("base64url");