go-pkgz / auth / 38118080234

87%

push

github

Accept only this provider's own confirmation tokens in verify login

LoginHandler accepted any token with a user::address handshake signed
with the service secret, including handshake tokens an application
issues for its own purposes, which are not login confirmations. A
session token, which has no handshake, caused a nil dereference.

The handler now requires a handshake and a provider name matching its
own before the replay store is touched, and rejects anything else with
403. Its own confirmation requests have set that name since 2024. The
rejected token is redacted from the logged request.

Mirrored in v1 and v2. The confirmation fixtures are re-minted with the
provider name, as the confirmation request produces them.

5 of 5 new or added lines in 1 file covered. (100.0%)

3306 of 3814 relevant lines covered (86.68%)

9.78 hits per line