Skip to content

fix(pwa): reject malformed signed cookies - #68

Merged
ralyodio merged 1 commit into
moshcoder:mainfrom
aiirvizionz:clientkit/reject-extra-signed-cookie-segments
Jul 30, 2026
Merged

fix(pwa): reject malformed signed cookies#68
ralyodio merged 1 commit into
moshcoder:mainfrom
aiirvizionz:clientkit/reject-extra-signed-cookie-segments

Conversation

@aiirvizionz

Copy link
Copy Markdown
Contributor

Summary

  • require signed cookie values to have exactly payload.mac segments
  • reject malformed signed cookies with extra dotted suffixes instead of accepting the original payload
  • add focused coverage for valid signed cookies and malformed extra-segment values

Test

  • node --test apps/pwa/test/crypto-cookie.test.mjs

@ralyodio
ralyodio merged commit 60f8039 into moshcoder:main Jul 30, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants