e04928c9
login: take the unified-login cookie decode from ecore
authn's CookieName, the fernet decrypt, the auth.AuthCookie unmarshal and the empty-name check were one of six copies of the same decode on this instance. They are now sr-ht-ecore/login.UsernameFromRequest; what stays here is the half that is ours, turning that name into a row in our user table. Two things the local copy did not do. It passed the cookie's name through with a leading '~' still on it, which meta answers for nobody, and it validated nothing at all — a name went from an attacker-supplied cookie straight into a GraphQL query and a log line. Both are now login's, and the middleware's own rule is unchanged: every failure is anonymity, so public browsing and public clones keep working.
Eugene Blikh <bigbes@gmail.com> — 2026-08-08 21:22:19 UTC
Commit e04928c9954cfe97811816cdbe87ab8a36db0a06 —
view raw patch
Parent(s):
d84a877c
| File | Status | + | − |
|---|---|---|---|
authn/authn_test.go
|
M | +7 | |
authn/cookie.go
|
M | +30 | -34 |
authn/cookie_test.go
|
M | +85 | -58 |