Upstream/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2024-06-30 11:14:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add 'expire' to filter invalid tokens

Browse Source
This commit is contained in:
Omar Roth 2018-11-19 18:41:11 -06:00
parent b535de690e
commit ad20d6359b
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
config/sql/nonces.sql
View File

@ -4,7 +4,8 @@
CREATE TABLE public.nonces
(
nonce text
nonce text,
expire timestamp with time zone,
)
WITH (
OIDS=FALSE

2
src/invidious/users.cr
View File

@ -203,7 +203,7 @@ end
def create_response(user_id, operation, key, db, expire = 6.hours)
expire = Time.now + expire
nonce = Random::Secure.hex(16)
db.exec("INSERT INTO nonces VALUES ($1) ON CONFLICT DO NOTHING", nonce)
db.exec("INSERT INTO nonces VALUES ($1, $2) ON CONFLICT DO NOTHING", nonce, expire)
challenge = "#{expire.to_unix}-#{nonce}-#{user_id}-#{operation}"
token = OpenSSL::HMAC.digest(:sha256, key, challenge)