Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-20 22:42:53 -05:00
Code Issues Activity

Added a note on secret transformation before token verification

Browse source 
refs #9865

- Added some clarificatoin around why secret used for token verification has to be transformed binary decoded from hex
This commit is contained in:
Nazar Gargol 2019-02-01 14:04:25 +00:00
parent 11c910ec8c
commit 3274138ff3
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
core/server/services/auth/api-key/admin.js
View file

@ -84,6 +84,10 @@ const authenticate = (req, res, next) => {
})); }));
} }
// Decoding from hex and transforming into bytes is here to
// keep comparison of the bytes that are stored in the secret.
// Useful context:
// https://github.com/auth0/node-jsonwebtoken/issues/208#issuecomment-231861138
const secret = Buffer.from(apiKey.get('secret'), 'hex'); const secret = Buffer.from(apiKey.get('secret'), 'hex');
// ensure the token was meant for this endpoint // ensure the token was meant for this endpoint