usbharu
/
misskey
mirror of https://github.com/misskey-dev/misskey.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(backend): use atomic command to improve security 

Co-Authored-By: Acid Chicken <root@acid-chicken.com>
This commit is contained in:
syuilo 2024-11-21 09:22:15 +09:00
parent 090e9392cd
commit 9fdabe3666
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/backend/src/core/WebAuthnService.ts
View File

@ -246,14 +246,12 @@ export class WebAuthnService {
@bindThis @bindThis
public async verifyAuthentication(userId: MiUser['id'], response: AuthenticationResponseJSON): Promise<boolean> { public async verifyAuthentication(userId: MiUser['id'], response: AuthenticationResponseJSON): Promise<boolean> {
const challenge = await this.redisClient.get(`webauthn:challenge:${userId}`); const challenge = await this.redisClient.getdel(`webauthn:challenge:${userId}`);
if (!challenge) { if (!challenge) {
throw new IdentifiableError('2d16e51c-007b-4edd-afd2-f7dd02c947f6', 'challenge not found'); throw new IdentifiableError('2d16e51c-007b-4edd-afd2-f7dd02c947f6', 'challenge not found');
} }
await this.redisClient.del(`webauthn:challenge:${userId}`);
const key = await this.userSecurityKeysRepository.findOneBy({ const key = await this.userSecurityKeysRepository.findOneBy({
id: response.id, id: response.id,
userId: userId, userId: userId,