Mattsson
550cadcb06
- Replace === with crypto.timingSafeEqual in all 7 cron routes via shared lib/auth/cron.ts - Add in-memory rate limiting (60 req/min) and expires_at support to calendar feed - Add exponential backoff on MFA verify after 3 failed attempts - Add 60s cooldown on password reset requests - Validate bank callback auth code format before API call - Redact session IDs from bank sync and callback logs - Validate OAuth redirect_uris against allowlist (claude.ai, claude.com, localhost) - Remove excessive PII/debug console logging from login page Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
33 lines
1.1 KiB
TypeScript
33 lines
1.1 KiB
TypeScript
import crypto from 'crypto'
|
|
import { NextResponse } from 'next/server'
|
|
|
|
/**
|
|
* Verify cron secret using constant-time comparison to prevent timing attacks.
|
|
* Expects `Authorization: Bearer <CRON_SECRET>` header.
|
|
*
|
|
* Returns null if authorized, or a 401 NextResponse if not.
|
|
*/
|
|
export function verifyCronSecret(request: Request): NextResponse | null {
|
|
const authHeader = request.headers.get('authorization')
|
|
const cronSecret = process.env.CRON_SECRET
|
|
|
|
if (!cronSecret || !authHeader) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const token = authHeader.startsWith('Bearer ')
|
|
? authHeader.substring(7)
|
|
: authHeader
|
|
|
|
// Use timingSafeEqual to prevent timing-based secret extraction.
|
|
// Encode both to buffers of equal length by hashing with SHA-256.
|
|
const tokenHash = crypto.createHash('sha256').update(token).digest()
|
|
const secretHash = crypto.createHash('sha256').update(cronSecret).digest()
|
|
|
|
if (!crypto.timingSafeEqual(tokenHash, secretHash)) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
return null
|
|
}
|