iv-org/invidious
1
0
Fork 0
mirror of https://gitea.invidious.io/iv-org/invidious synced 2025-06-05 23:29:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add 'expire' to filter invalid tokens

Browse Source
This commit is contained in:
Omar Roth
2018-11-19 18:41:11 -06:00
parent b535de690e
commit ad20d6359b
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/invidious/users.cr
View File

@@ -203,7 +203,7 @@ end
def create_response(user_id, operation, key, db, expire = 6.hours)
expire = Time.now + expire
nonce = Random::Secure.hex(16)
db.exec("INSERT INTO nonces VALUES ($1) ON CONFLICT DO NOTHING", nonce)
db.exec("INSERT INTO nonces VALUES ($1, $2) ON CONFLICT DO NOTHING", nonce, expire)
challenge = "#{expire.to_unix}-#{nonce}-#{user_id}-#{operation}"
token = OpenSSL::HMAC.digest(:sha256, key, challenge)