validate Google identity claims

2026-09-06 17:36:19 +03:00
parent cbb87d8094
commit d02b6f0f3c
1 changed files with 3 additions and 1 deletions
@@ -94,7 +94,9 @@ export async function loginWithGoogle(credential) {
  );
  if (p.aud !== clientId) throw new Error('aud eşleşmiyor');
  if (p.email_verified !== 'true' && p.email_verified !== true) throw new Error('e-posta doğrulanmamış');
-  const email = String(p.email).toLowerCase();
+  if (typeof p.sub !== 'string' || !p.sub.trim()) throw new Error('Google kullanıcı kimliği eksik');
+  if (typeof p.email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(p.email)) throw new Error('Geçerli e-posta eksik');
+  const email = p.email.toLowerCase();
  const isAdmin = isAdminEmail(email);
  const user = {
    email,