blitzwing/cobalt-7
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

api/jwt: fix timestamp to match the spec

Browse source
This commit is contained in:
wukko 2024-08-17 17:58:40 +06:00
parent 580ca042f3
commit 9592e59f76
No known key found for this signature in database
GPG key ID: 3E30B3F26C7B4AA2
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
api/src/security/jwt.js
View file

@ -12,7 +12,7 @@ const makeHmac = (header, payload) =>
.digest("base64url"); .digest("base64url");
export const generate = () => { export const generate = () => {
const exp = new Date().getTime() + env.jwtLifetime * 1000; const exp = Math.floor(new Date().getTime() / 1000) + env.jwtLifetime;
const header = toBase64URL(JSON.stringify({ const header = toBase64URL(JSON.stringify({
alg: "HS256", alg: "HS256",
@ -20,7 +20,7 @@ export const generate = () => {
})); }));
const payload = toBase64URL(JSON.stringify({ const payload = toBase64URL(JSON.stringify({
jti: nanoid(3), jti: nanoid(8),
exp, exp,
})); }));
@ -34,7 +34,7 @@ export const generate = () => {
export const verify = (jwt) => { export const verify = (jwt) => {
const [header, payload, signature] = jwt.split(".", 3); const [header, payload, signature] = jwt.split(".", 3);
const timestamp = new Date().getTime(); const timestamp = Math.floor(new Date().getTime() / 1000);
if ([header, payload, signature].join('.') !== jwt) { if ([header, payload, signature].join('.') !== jwt) {
return false; return false;

2
web/src/lib/api/session.ts
View file

@ -42,7 +42,7 @@ export const requestSession = async() => {
} }
export const getSession = async () => { export const getSession = async () => {
const currentTime = new Date().getTime(); const currentTime = Math.floor(new Date().getTime() / 1000);
const cache = get(cachedSession); const cache = get(cachedSession);
if (cache?.token && cache?.exp > currentTime) { if (cache?.token && cache?.exp > currentTime) {