Simon/romm
1
0
Fork 0
mirror of https://github.com/rommapp/romm.git synced 2026-06-27 22:35:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: TOCTOU race condition allows duplicate refresh token use

Browse Source
This commit is contained in:
HydroSulphide
2026-03-10 08:38:32 +01:00
parent 02336974a6
commit fd788684b9
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/handler/auth/base_handler.py
View File

@@ -310,7 +310,7 @@ class OAuthHandler:
raise OAuthCredentialsException
jti = payload.claims.get("jti")
if not jti or redis_client.get(f"refresh-jti:{jti}") != b"valid":
if not jti or redis_client.getdel(f"refresh-jti:{jti}") != b"valid":
raise OAuthCredentialsException
username = payload.claims.get("sub")
@@ -323,8 +323,6 @@ class OAuthHandler:
if not user.enabled:
raise UserDisabledException
redis_client.delete(f"refresh-jti:{jti}")
return user, payload.claims
async def get_current_active_user_from_bearer_token(self, token: str):