Store challenge from handleGetChallenge in session, then verify against it in handleSolve. Previously a fresh challenge was generated for verification, making auth trivially bypassable. |
||
|---|---|---|
| .. | ||
| bandwidth.go | ||
| server.go | ||
| session.go | ||
Store challenge from handleGetChallenge in session, then verify against it in handleSolve. Previously a fresh challenge was generated for verification, making auth trivially bypassable. |
||
|---|---|---|
| .. | ||
| bandwidth.go | ||
| server.go | ||
| session.go | ||