go-pkgz / auth / 42677216081

87%

master: 87%

Pull #329

github

fix: reject expired oauth handshake tokens on the callback

The login step gives the handshake a 30 minute expiry, but Get skips the
expiry check for cookies, so the callbacks accepted a handshake of any
age. The cookie-only lookup now rejects a token whose exp has passed.
A token without exp is still accepted, the same in both modules.

19 of 19 new or added lines in 4 files covered. (100.0%)

3378 of 3880 relevant lines covered (87.06%)

10.44 hits per line