| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | sockets: verify JWT signatures on the websocket auth path (S1) | Adam Soltys | 2026-08-07 | 1 | -2/+14 |
| | | | | | | | | | | | | | | | The websocket auth gate used jwt.decode(), which parses the payload but never checks the signature — anyone could forge {id: <victim uid>} (alg:none or any key), register their socket under the victim's uid, and receive every emit for that account. Switch both track() and the "login" gate to jwt.verify(token, config.jwt), rejecting forged/altered tokens. Also project the full-record socket emits through pick(user, whitelist) so a "user" event can never carry the bcrypt hash, TOTP secret, or PIN — matching the shape /login and /me already return. Co-Authored-By: Claude Opus 4.8 <[email protected]> | ||||
| * | log login failures | Adam Soltys | 2025-02-04 | 1 | -1/+1 |
| | | |||||
| * | biome lint | Adam Soltys | 2024-10-31 | 1 | -12/+13 |
| | | |||||
| * | rm log | Adam Soltys | 2024-10-12 | 1 | -1/+0 |
| | | |||||
| * | rm log | Adam Soltys | 2024-10-12 | 1 | -1/+0 |
| | | |||||
| * | clean up invoice subscriptions | Adam Soltys | 2024-10-11 | 1 | -0/+6 |
| | | |||||
| * | check invoice id not hash | Adam Soltys | 2024-10-11 | 1 | -5/+5 |
| | | |||||
| * | more ts housekeeping | Adam Soltys | 2024-08-26 | 1 | -6/+2 |
| | | |||||
| * | typescript | Adam Soltys | 2024-08-26 | 1 | -0/+161 |
 |
index : coinos-server.git | |
| coinos server — legacy coinos.io backend (Lightning, on-chain, Liquid) | coinos |
| aboutsummaryrefslogtreecommitdiffstats |