patched security holes

2026-02-08 10:33:01 +00:00 · 2026-01-21 22:44:57 +00:00
parent db0be8330e
commit be57b4d6df
11 changed files with 129 additions and 23 deletions
--- a/packages/backend/src/auth/middleware.ts
+++ b/packages/backend/src/auth/middleware.ts
@@ -35,6 +35,10 @@ export const withAuth = <T extends BunRequest>(handler: AuthedRouteHandler<T>):
                return new Response("Session expired", { status: 401 });
            }

+            if (session.userId !== userId) {
+                return new Response("Invalid session", { status: 401 });
+            }
+
            return handler(
                Object.assign(req, {
                    userId,