mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 14:08:45 -04:00
Gigi
d5ad610c3d
* auth: make the login challenge nonce one-time The per-login challenge nonce stored in the session was never consumed or cleared, so a captured challenge stayed replayable and survived logout (CWE-294). The client (p/scripts/extra.js) already fetches a fresh nonce for every attempt, so consuming it does not affect legitimate retries. Consume the nonce (unset it) as soon as it is read for verification in form login, reauthentication, password change and account self-deletion, and clear it in FreshRSS_Auth::removeAccess so logout invalidates any outstanding challenge. * auth: don't clear the nonce in removeAccess (breaks login) removeAccess() runs on every unauthenticated request via FreshRSS_Auth::init() -- including the login POST itself, before formLoginAction reads the nonce -- so clearing it there rejected every login with 'Invalid session'. Thanks @jamalkamaladdin for the measured catch. The one-time guarantee is preserved by consuming the nonce when it is read for verification (login/reauth/password change/self-deletion); logout no longer needs a separate clear.