github-such-software/wownerogue
1
0
Fork 0
mirror of https://github.com/Such-Software/wownerogue.git synced 2026-10-19 07:08:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix smirk login

Browse Source
This commit is contained in:
jwinterm
2026-02-07 11:40:07 -05:00
parent a56063867e
commit f8ae69304a
2 changed files with 233 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/index.js
+4 -2
View File
@@ -520,12 +520,14 @@ app.post('/api/auth/smirk/verify', asyncHandler(async (req, res) => {
let isValidSignature = false;
try {
const nacl = require('tweetnacl');
const challengeBytes = Buffer.from(challenge, 'hex');
// The Smirk extension signs SHA256(utf8(challenge)), not the raw challenge bytes.
// We must hash the challenge the same way before verifying.
const challengeHash = crypto.createHash('sha256').update(challenge).digest();
const signatureBytes = Buffer.from(signature, 'hex');
const publicKeyBytes = Buffer.from(publicKey, 'hex');
// tweetnacl.sign.detached.verify(message, signature, publicKey)
isValidSignature = nacl.sign.detached.verify(challengeBytes, signatureBytes, publicKeyBytes);
isValidSignature = nacl.sign.detached.verify(challengeHash, signatureBytes, publicKeyBytes);
} catch (verifyError) {
console.error('Signature verification error:', verifyError.message);
throw new ValidationError('Signature verification failed', {