mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
803a7cb64a
The callback hands the finished login back as a code in a redirect URL, and /exchange turned any code into a session. That made the code the whole credential while it travelled somewhere URLs are readable: browser history on a shared machine, a referrer, a reverse proxy log. It cuts both ways. Redeem a code you saw over someone's shoulder and you are them; or complete a login as yourself, hand the victim's browser your code, and they are silently signed into your account and write their next trip into it. The callback now also sets a one-minute httpOnly cookie holding a random secret, and /exchange wants the code plus that cookie. Only the browser that came back from the provider holds both, which is the same shape the state cookie already gives the callback. The code is burnt on every attempt, right or wrong, and an unbound code answers exactly like an unknown one so presenting one confirms nothing.