fail closed on missing auth secret

2026-09-06 17:34:13 +03:00
parent 0759c3e0ac
commit d9b6e11582
1 changed files with 3 additions and 1 deletions
@@ -44,7 +44,9 @@ export function signToken(payload) {
 export function verifyToken(token) {
  if (!token || typeof token !== 'string' || !token.includes('.')) return null;
  const [data, sig] = token.split('.');
-  const expected = b64url(crypto.createHmac('sha256', AUTH_SECRET()).update(data).digest());
+  let secret;
+  try { secret = AUTH_SECRET(); } catch { return null; }
+  const expected = b64url(crypto.createHmac('sha256', secret).update(data).digest());
  if (
    sig.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))