Hornwitser
c9976af26b
If a cookie is signed for one purpose, but the server also uses a differently named signed cookie name for another purpose, then it's possible for a malicious client to substitute the value of one signed cookie with the value of another and have it pass the signature check. Include the name of the cookie when computing the signature so that no cookies signed for example for "user_session" can be used as a value for a hypothetical "admin_session" cookie. |
||
|---|---|---|
| .. | ||
| api | ||
| utils | ||
| database.ts | ||
| generate-demo-schedule.ts | ||
| streams.ts | ||
| tsconfig.json | ||
| web-push.ts | ||