naibaandcloudcode 834ae25024 fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie ...

- consumeTransferToken now recomputes and constant-time compares the
  entry's HMAC-SHA256; previously the signature was minted but never
  checked, so the documented "防篡改" guarantee was hollow and security
  rested solely on the sync.Map key's randomness.
- CSRF switches from a raw-random double-submit cookie to a signed token
  (nonce.HMAC-SHA256 keyed by JWTSecretKey). The middleware now also
  validates the signature, defeating sibling-subdomain cookie tossing
  where a naive header==cookie pair would otherwise pass.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 05:48:50 +00:00

..

dashboard

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00