iv-org-mirror/invidious-copy-2022-03-16
1
0
Fork 0
mirror of https://gitea.invidious.io/iv-org/invidious-copy-2022-03-16.git synced 2024-08-15 00:53:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add 'expire' to filter invalid tokens

Browse source
This commit is contained in:
Omar Roth 2018-11-19 18:41:11 -06:00
parent b535de690e
commit ad20d6359b
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
config/sql/nonces.sql
View file

@ -4,7 +4,8 @@
CREATE TABLE public.nonces CREATE TABLE public.nonces
( (
nonce text nonce text,
expire timestamp with time zone,
) )
WITH ( WITH (
OIDS=FALSE OIDS=FALSE

2
src/invidious/users.cr
View file

@ -203,7 +203,7 @@ end
def create_response(user_id, operation, key, db, expire = 6.hours) def create_response(user_id, operation, key, db, expire = 6.hours)
expire = Time.now + expire expire = Time.now + expire
nonce = Random::Secure.hex(16) nonce = Random::Secure.hex(16)
db.exec("INSERT INTO nonces VALUES ($1) ON CONFLICT DO NOTHING", nonce) db.exec("INSERT INTO nonces VALUES ($1, $2) ON CONFLICT DO NOTHING", nonce, expire)
challenge = "#{expire.to_unix}-#{nonce}-#{user_id}-#{operation}" challenge = "#{expire.to_unix}-#{nonce}-#{user_id}-#{operation}"
token = OpenSSL::HMAC.digest(:sha256, key, challenge) token = OpenSSL::HMAC.digest(:sha256, key, challenge)