go-pkgz / auth / 38117006047

87%

master: 87%

Pull #319

github

Accept only this provider's own confirmation tokens in verify login

LoginHandler accepted any token with a user::address handshake signed
with the service secret, including handshake tokens an application
issues for its own purposes, which are not login confirmations. A
session token, which has no handshake, caused a nil dereference.

The handler now requires a handshake and a provider name matching its
own before the replay store is touched, and rejects anything else with
403. Its own confirmation requests have set that name since 2024. The
rejected token is redacted from the logged request.

Mirrored in v1 and v2. The confirmation fixtures are re-minted with the
provider name, as the confirmation request produces them.

5 of 5 new or added lines in 1 file covered. (100.0%)

3337 of 3848 relevant lines covered (86.72%)

9.86 hits per line