From c557ec8dd5fe52dd629d75c2f9c954d4c069ab7a Mon Sep 17 00:00:00 2001 From: FuturMix Date: Sun, 14 Jun 2026 12:20:33 +0800 Subject: [PATCH] fix(auth): use base64url encoding in session signature verification (fixes #64) --- apps/logicsrc-web/src/lib/coinpay.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/logicsrc-web/src/lib/coinpay.ts b/apps/logicsrc-web/src/lib/coinpay.ts index dae83d7..cc56d6e 100644 --- a/apps/logicsrc-web/src/lib/coinpay.ts +++ b/apps/logicsrc-web/src/lib/coinpay.ts @@ -166,8 +166,8 @@ export function verifySession(value: string): Record | null { if (!encoded || !signature) return null; const expected = createHmac("sha256", getSessionSecret()).update(encoded).digest("base64url"); - const actualBuffer = Buffer.from(signature); - const expectedBuffer = Buffer.from(expected); + const actualBuffer = Buffer.from(signature, "base64url"); + const expectedBuffer = Buffer.from(expected, "base64url"); if (actualBuffer.length !== expectedBuffer.length || !timingSafeEqual(actualBuffer, expectedBuffer)) { return null; }