captcha

2 files changed, 18 insertions, 5 deletions

diff --git a/src/routes/(static)/login/+page.server.ts b/src/routes/(static)/login/+page.server.ts
index ffe6335d..f75b88d8 100644
--- a/src/routes/(static)/login/+page.server.ts
+++ b/src/routes/(static)/login/+page.server.ts
@@ -1,20 +1,32 @@
+import { randomUUID } from "crypto";
 import { PUBLIC_COINOS_URL } from "$env/static/public";
 import { fd, get, login } from "$lib/utils";
 import { fail, redirect } from "@sveltejs/kit";
 
+const captchas = new Set();
 export const load = async ({ parent }) => {
 	const { user } = await parent();
 	if (user?.pubkey) redirect(307, `/${user.username}`);
 	const { challenge } = await get("/challenge");
-	return { challenge };
+	const captcha = randomUUID();
+	captchas.add(captcha);
+	setTimeout(() => captchas.delete(captcha), 120000);
+	return { challenge, captcha };
 };
 
 export const actions = {
 	login: async ({ cookies, request }) => {
-    console.log(request.headers.get('referer'));
 		const form = await fd(request);
-		let { username, password, token, loginRedirect } = form;
-		const user = { username, password, token };
+		let { username, password, token, loginRedirect, captcha } = form;
+		console.log(captchas, captchas.has(captcha), captcha);
+		if (!captchas.has(captcha))
+			return fail(400, { error: "Login form expired", message: "Login form expired", ...form });
+
+		const user = {
+			username,
+			password,
+			token,
+		};
 
 		if (loginRedirect === "undefined") loginRedirect = undefined;
 
diff --git a/src/routes/(static)/login/+page.svelte b/src/routes/(static)/login/+page.svelte
index 825f6a88..dc43e76d 100644
--- a/src/routes/(static)/login/+page.svelte
+++ b/src/routes/(static)/login/+page.svelte
@@ -36,7 +36,7 @@
     if (lang) document.cookie = `lang=${lang} ;`;
   });
 
-  let { challenge } = $derived(data);
+  let { challenge, captcha } = $derived(data);
   let token = $state("");
 
   let cancel = () => (need2fa = false);
@@ -142,6 +142,7 @@
   >
     <input type="hidden" name="loginRedirect" value={redirect} />
     <input type="hidden" name="token" value={token} />
+    <input type="hidden" name="captcha" value={captcha} />
 
     <input
       name="username"