hikmettan/ihaleist
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fail closed on missing auth secret

Browse Source
This commit is contained in:
hikmettan
2026-09-06 17:34:13 +03:00
parent 0759c3e0ac
commit d9b6e11582
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/auth.mjs
+3 -1
View File
@@ -44,7 +44,9 @@ export function signToken(payload) {
export function verifyToken(token) { export function verifyToken(token) {
if (!token || typeof token !== 'string' || !token.includes('.')) return null; if (!token || typeof token !== 'string' || !token.includes('.')) return null;
const [data, sig] = token.split('.'); const [data, sig] = token.split('.');
const expected = b64url(crypto.createHmac('sha256', AUTH_SECRET()).update(data).digest()); let secret;
try { secret = AUTH_SECRET(); } catch { return null; }
const expected = b64url(crypto.createHmac('sha256', secret).update(data).digest());
if ( if (
sig.length !== expected.length || sig.length !== expected.length ||
!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))