chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(identity): retain verified OIDC subject in web session

Browse Source
This commit is contained in:
Chris Christiansen 2026-09-19 18:05:59 +00:00
parent 8aa533eecc
commit 25b3deb19b
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
opax-web/backend/server.js
View File

@ -57,7 +57,10 @@ app.get('/auth/callback', async (req, res, next) => {
let { tokens } = await oauth.getToken(req.query.code);
let p = (await oauth.verifyIdToken({ idToken: tokens.id_token, audience: process.env.GOOGLE_CLIENT_ID })).getPayload();
if (!p?.email || !emails.has(p.email)) return res.status(403).send('Not authorised');
req.session.user = { email: p.email, name: p.name || p.email };
if (typeof p.sub !== "string" || !p.sub.trim()) {
return next(new Error('Verified Google ID token missing subject'));
}
req.session.user = { email: p.email, name: p.name || p.email, sub: p.sub };
res.redirect('/');
} catch (e) {
next(e);