GlcoinCore/btc-rpc-explorer
1
0
Fork 0
mirror of https://github.com/janoside/btc-rpc-explorer.git synced 2026-08-13 12:33:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix #311

Browse source
This commit is contained in:
Dan Janosik 2021-04-16 09:46:20 -04:00
parent 508e8487f1
commit 587a304c96
No known key found for this signature in database
GPG key ID: 846311D3D259BFF1
1 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

18
app/sso.js
View file

@ -12,6 +12,7 @@
const crypto = require('crypto');
const fs = require('fs');
const utils = require("./utils.js");
const authCookieName = "btcexp_auth";
@ -52,11 +53,22 @@ module.exports = (tokenFile, loginRedirect) => {
return next();
}
// We have to use timingSafeEqual to avoid timing attacks
if (crypto.timingSafeEqual(Buffer.from(req.query.token, "utf8"), Buffer.from(token, "utf8"))) {
let matchingToken = false;
if (req.query.token) {
try {
// We use timingSafeEqual to avoid timing attacks
matchingToken = crypto.timingSafeEqual(Buffer.from(req.query.token, "utf8"), Buffer.from(token, "utf8"));
} catch (e) {
utils.logError("23rheuweesaa", e);
}
}
if (matchingToken) {
req.authenticated = true;
token = updateToken(tokenFile);
cookie = generateToken();
let cookie = generateToken();
cookies.add(cookie);
res.cookie(authCookieName, cookie);