From d02b6f0f3cdc4edabcdbaf78327ed12fa59d9771 Mon Sep 17 00:00:00 2001 From: ht Date: Sun, 6 Sep 2026 17:36:19 +0300 Subject: [PATCH] validate Google identity claims --- server/auth.mjs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/server/auth.mjs b/server/auth.mjs index 847e4d0..ed943fc 100644 --- a/server/auth.mjs +++ b/server/auth.mjs @@ -94,7 +94,9 @@ export async function loginWithGoogle(credential) { ); if (p.aud !== clientId) throw new Error('aud eşleşmiyor'); if (p.email_verified !== 'true' && p.email_verified !== true) throw new Error('e-posta doğrulanmamış'); - const email = String(p.email).toLowerCase(); + if (typeof p.sub !== 'string' || !p.sub.trim()) throw new Error('Google kullanıcı kimliği eksik'); + if (typeof p.email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(p.email)) throw new Error('Geçerli e-posta eksik'); + const email = p.email.toLowerCase(); const isAdmin = isAdminEmail(email); const user = { email,