lug/invidious
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add 'expire' to filter invalid tokens

Browse Source
This commit is contained in:
Omar Roth 2018-11-19 18:41:11 -06:00
parent b535de690e
commit ad20d6359b
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
config/sql/nonces.sql
View File

@ -4,7 +4,8 @@
CREATE TABLE public.nonces CREATE TABLE public.nonces
( (
nonce text nonce text,
expire timestamp with time zone,
) )
WITH ( WITH (
OIDS=FALSE OIDS=FALSE

2
src/invidious/users.cr
View File

@ -203,7 +203,7 @@ end
def create_response(user_id, operation, key, db, expire = 6.hours) def create_response(user_id, operation, key, db, expire = 6.hours)
expire = Time.now + expire expire = Time.now + expire
nonce = Random::Secure.hex(16) nonce = Random::Secure.hex(16)
db.exec("INSERT INTO nonces VALUES ($1) ON CONFLICT DO NOTHING", nonce) db.exec("INSERT INTO nonces VALUES ($1, $2) ON CONFLICT DO NOTHING", nonce, expire)
challenge = "#{expire.to_unix}-#{nonce}-#{user_id}-#{operation}" challenge = "#{expire.to_unix}-#{nonce}-#{user_id}-#{operation}"
token = OpenSSL::HMAC.digest(:sha256, key, challenge) token = OpenSSL::HMAC.digest(:sha256, key, challenge)