Nail/ipwhitelist-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bump 0.5.30 — restore state check, clean code

Browse Source
This commit is contained in:
naeel
2026-06-09 21:59:26 +04:00
parent a39f97f3b4
commit 9b76333b22
2 changed files with 6 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/oidc.js
+5 -11
View File
@@ -32,15 +32,11 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
router.get('/callback', async (req, res) => {
const { code, state } = req.query;
// ⚠️ ВРЕМЕННО: проверка state отключена для тестирования (2026-06-09)
// 🔮 Вернуть когда заработает SSO на managed
// Проверка state (защита от CSRF на callback)
// if (!state || state !== req.session.oidcState) {
// return res.status(403).send('Invalid state parameter');
// }
// delete req.session.oidcState;
if (req.session) delete req.session.oidcState;
if (!state || state !== req.session.oidcState) {
return res.status(403).send('Invalid state parameter');
}
delete req.session.oidcState;
if (!code) {
return res.status(400).send('Missing authorization code');
@@ -48,9 +44,7 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
try {
// Обмен code на токен (через IAM / Keycloak)
const tokenData = await auth.exchangeCode(code).catch(e => {
throw new Error('Code exchange failed: ' + (e.message || e) + ' [KC_BASE_URL=' + process.env.KC_BASE_URL + ', code=' + (code || '').slice(0, 8) + '...]');
});
const tokenData = await auth.exchangeCode(code);
const accessToken = tokenData.accessToken;
if (!accessToken) throw new Error('No access_token in response');