Pouzor
6ace796c8b
C2 - JWT token was stored in localStorage (XSS-accessible):
- Switch Zustand persist storage from localStorage to sessionStorage
- Token is now scoped to the current tab and cleared on browser close
H5 - docker-compose had unsafe SECRET_KEY fallback:
- Replace ${SECRET_KEY:-change_me_in_production} with :? syntax
- Docker Compose now aborts with a clear error if SECRET_KEY is unset
M1 - Login endpoint had timing leak allowing username enumeration:
- Always call verify_password() regardless of username match
- Use hmac.compare_digest() for constant-time username comparison
- Both checks run every time; attacker cannot distinguish wrong
username from wrong password via response timing
27 lines
738 B
TypeScript
27 lines
738 B
TypeScript
import { create } from 'zustand'
|
|
import { persist, createJSONStorage } from 'zustand/middleware'
|
|
|
|
interface AuthState {
|
|
token: string | null
|
|
isAuthenticated: boolean
|
|
login: (token: string) => void
|
|
logout: () => void
|
|
}
|
|
|
|
export const useAuthStore = create<AuthState>()(
|
|
persist(
|
|
(set) => ({
|
|
token: null,
|
|
isAuthenticated: false,
|
|
login: (token) => set({ token, isAuthenticated: true }),
|
|
logout: () => set({ token: null, isAuthenticated: false }),
|
|
}),
|
|
{
|
|
name: 'homelable-auth',
|
|
// sessionStorage: scoped to the tab, cleared on browser close.
|
|
// Prevents XSS from other tabs stealing the token via localStorage.
|
|
storage: createJSONStorage(() => sessionStorage),
|
|
}
|
|
)
|
|
)
|