Niko/qcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

handleAuthCert: reject cert-auth when number differs from session

Browse source 
If session already has a number (from PoW), cert auth must match that number. Prevents identity theft via cert-sharing.
This commit is contained in:
Niko Marmeladkov 2026-07-01 14:59:39 +03:00
parent b7597e1335
commit 12f38ecb68
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
internal/server/server.go
View file

@ -351,7 +351,8 @@ func (s *Server) handleAuthCert(sess *Session, payload []byte) {
}
if sess.IsAuthenticated() && sess.Number() != ident.Number {
s.Unregister(sess.Number())
sendOpError(sess.Stream(), types.ErrAuthFailed, "cert number mismatch")
return
}
sess.Authenticate(ident.Number, pubKey, certDER)