Jackie/rentall-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

query parameter token could be leaked

Browse Source
This commit is contained in:
jackiettran
2026-01-15 16:26:53 -05:00
parent 18a37e2996
commit 1b6f782648
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
backend/sockets/socketAuth.js
View File

@@ -8,7 +8,7 @@ const cookie = require("cookie");
* Verifies JWT token and attaches user to socket * Verifies JWT token and attaches user to socket
* Tokens can be provided via: * Tokens can be provided via:
* 1. Cookie (accessToken) - preferred for browser clients * 1. Cookie (accessToken) - preferred for browser clients
* 2. Query parameter (token) - fallback for mobile/other clients * 2. Auth object (auth.token) - for mobile/native clients
*/ */
const authenticateSocket = async (socket, next) => { const authenticateSocket = async (socket, next) => {
try { try {
@@ -20,16 +20,11 @@ const authenticateSocket = async (socket, next) => {
token = cookies.accessToken; token = cookies.accessToken;
} }
// Fallback to query parameter (mobile/other clients) // Auth object for mobile/native clients
if (!token && socket.handshake.auth?.token) { if (!token && socket.handshake.auth?.token) {
token = socket.handshake.auth.token; token = socket.handshake.auth.token;
} }
// Fallback to legacy query parameter
if (!token && socket.handshake.query?.token) {
token = socket.handshake.query.token;
}
if (!token) { if (!token) {
logger.warn("Socket connection rejected - no token provided", { logger.warn("Socket connection rejected - no token provided", {
socketId: socket.id, socketId: socket.id,
@@ -69,7 +64,9 @@ const authenticateSocket = async (socket, next) => {
userVersion: user.jwtVersion, userVersion: user.jwtVersion,
}); });
return next( return next(
new Error("Session expired due to password change. Please log in again.") new Error(
"Session expired due to password change. Please log in again."
)
); );
} }