TheSunIsLeaking/recflare
3
0
Fork 0
mirror of https://github.com/djdevin/recflare.git synced 2026-09-09 15:11:29 -07:00
Code Issues Packages Projects Releases Wiki Activity

error out when JWT missing

Browse Source
This commit is contained in:
Devin Zuczek
2026-07-14 20:37:32 -04:00
parent 3e8f66b620
commit 8314e54439
1 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/auth/src/auth.app.ts
+13 -5
View File
@@ -439,12 +439,20 @@ const app = new Hono<App>()
await setLoginContext(c.env.DB, resolvedId, { deviceId, deviceClass, ip: clientIp }) await setLoginContext(c.env.DB, resolvedId, { deviceId, deviceClass, ip: clientIp })
} }
const accessToken = await generateToken( // Never sign with an empty key. An empty JWT_SECRET (misconfigured/missing
accountId, // binding) would still yield a well-formed token — but one signed with an empty
platformId, // key, which every worker validates against, so anyone could forge it. Refuse to
platform, // issue a token at all rather than complete the login with a forgeable credential.
await c.env.JWT_SECRET.get() const jwtSecret = await c.env.JWT_SECRET.get()
if (jwtSecret === '') {
logger.error('refusing to issue token: JWT_SECRET is empty')
return c.json(
{ error: 'server_error', error_description: 'token signing is not configured' },
500
) )
}
const accessToken = await generateToken(accountId, platformId, platform, jwtSecret)
// Issue a fresh, persisted refresh token (single-use; the client redeems it via // Issue a fresh, persisted refresh token (single-use; the client redeems it via
// grant_type=refresh_token). A refresh grant thus rotates its token. // grant_type=refresh_token). A refresh grant thus rotates its token.
const refreshToken = await issueRefreshToken(c.env.DB, { const refreshToken = await issueRefreshToken(c.env.DB, {