mmo-ref/drop
1
0
Fork 0
mirror of https://github.com/Drop-OSS/drop synced 2026-08-27 14:23:05 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(server): prevent session fixation by always issuing new signin token

Browse source 
session/index.ts:73 reused getSessionToken(h3) ?? createSessionCookie(...) — pre-set cookies persisted across signin. Now always calls createSessionCookie and invalidates old session via removeSession.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
John Smith 2026-07-25 19:10:33 -04:00
parent 508179176f
commit 3a762c2f7d
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
server/server/internal/session/index.ts
View file

@ -70,8 +70,13 @@ export class SessionHandler {
const expiresAt = this.createExipreAt(rememberMe);
const token =
this.getSessionToken(h3) ?? this.createSessionCookie(h3, expiresAt);
// Invalidate any pre-existing session token — prevents session fixation
const oldToken = this.getSessionToken(h3);
const token = this.createSessionCookie(h3, expiresAt);
if (oldToken) {
await this.sessionProvider.removeSession(oldToken);
}
const defaultSession: Session = {
expiresAt,
data,