FIWARE / VCVerifier / 39584087980

74%

main: 75%

Pull #132

github

fix(openapi): do not log a waiting connection with a wrong secret as accepted

In warn mode, handleMessage logged every wrong page secret as "accepted
because server.webSocketSessionBinding is warn". A connection that
waits unregistered - because the session's registered connection
authenticated - is not accepted: it keeps waiting and never gets the
login. Logging it as accepted misled anyone investigating a takeover
attempt.

A waiting connection with a wrong secret now gets its own warning,
saying it keeps waiting and may be an attempt to take the login over.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

225 of 260 new or added lines in 5 files covered. (86.54%)

9316 of 12609 relevant lines covered (73.88%)

0.85 hits per line