prevent session cookie to change ip
Massimo Melina committed
Jun 25, 2023 at 22:58 UTC
1199e597daa16e93179af6a7ac2cc561bf9b0a4c
1 file changed
+8
src/middlewares.ts
+8
@@ -192,6 +192,14 @@ async function sendFolderList(node: VfsNode, ctx: Koa.Context) {
192
let proxyDetected: undefined | Koa.Context
193
export const someSecurity: Koa.Middleware = async (ctx, next) => {
194
ctx.request.ip = normalizeIp(ctx.ip)
195
+ // don't allow sessions to change ip
196
+ const ss = ctx.session
197
+ if (ss?.username)
198
+ if (!ss.ip)
199
+ ss.ip = ctx.ip
200
+ else if (ss.ip !== ctx.ip)
201
+ delete ss.username
202
+
203
try {
204
if (dirTraversal(decodeURI(ctx.path)))
205
return ctx.status = HTTP_FOOL