From 94582453820655d11cb6dff8ad62148742591103 Mon Sep 17 00:00:00 2001 From: syuilo Date: Fri, 6 Jan 2017 11:50:46 +0900 Subject: [BREAKING CHANGE] Improve security --- src/api/endpoints/auth/accept.js | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'src/api/endpoints/auth/accept.js') diff --git a/src/api/endpoints/auth/accept.js b/src/api/endpoints/auth/accept.js index 7c45650c6b..9eb5d2e7e2 100644 --- a/src/api/endpoints/auth/accept.js +++ b/src/api/endpoints/auth/accept.js @@ -4,6 +4,8 @@ * Module dependencies */ import rndstr from 'rndstr'; +const crypto = require('crypto'); +import App from '../../models/app'; import AuthSess from '../../models/auth-session'; import Userkey from '../../models/userkey'; @@ -41,12 +43,23 @@ module.exports = (params, user) => }); if (exist === null) { + // Lookup app + const app = await App.findOne({ + app_id: session.app_id + }); + + // Generate Hash + const sha512 = crypto.createHash('sha512'); + sha512.update(key + app.secret); + const hash = sha512.digest('hex'); + // Insert userkey doc await Userkey.insert({ created_at: new Date(), app_id: session.app_id, user_id: user._id, - key: key + key: key, + hash: hash }); } -- cgit v1.3.1-freya