luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(19): IN-01 validate LOCAL_SESSION_EXPIRES coercion (fallback on NaN/non-positive)

Browse Source
This commit is contained in:
Lucas Berger
2026-06-17 20:34:14 -04:00
parent 4bd6b2c057
commit f2fc1404d4
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/auth/localSession.ts
+9 -2
View File
@@ -27,8 +27,15 @@ import type { Context } from 'hono';
// Cookie name must be distinct from the OIDC cookie 'oidc-auth' (Pitfall 4) // Cookie name must be distinct from the OIDC cookie 'oidc-auth' (Pitfall 4)
const COOKIE_NAME = 'local-session'; const COOKIE_NAME = 'local-session';
// Session max age: default 1 day (86400s); configurable via LOCAL_SESSION_EXPIRES env // Session max age: default 1 day (86400s); configurable via LOCAL_SESSION_EXPIRES env.
const SESSION_MAX_AGE_SECONDS = Number(process.env.LOCAL_SESSION_EXPIRES ?? 86400); // IN-01: validate the coercion. A malformed value yields NaN, which would produce a JWT
// with exp = now + NaN (→ NaN) and a cookie maxAge: NaN — making verify behaviour
// "always expired" or "never expires" depending on the lib's NaN handling. Fall back to
// the 86400s default for any non-finite or non-positive value.
const SESSION_MAX_AGE_SECONDS = (() => {
const n = Number(process.env.LOCAL_SESSION_EXPIRES ?? 86400);
return Number.isFinite(n) && n > 0 ? n : 86400;
})();
/** /**
* Issue a signed local-session JWT cookie for the given userId. * Issue a signed local-session JWT cookie for the given userId.