Code Terrier found 1 new issue — 1 security.
Open in Code Terriersrc/auth/session.ts:25+1 −0| 23 | 23 | const token = await findToken(value); |
| 24 | 24 | if (!token) return null; |
| 25 | + return issueSession(token.userId); | |
| 25 | 26 | } |
🔒 过期凭据仍然能创建新会话。
此路径未检查有效期就签发会话。先检查 token.expiresAt,再创建新会话。
Suggested change
| 25 | - return issueSession(token.userId); |
| 25 | + if (token.expiresAt <= Date.now()) { |
| 26 | + return null; |
| 27 | + } |
| 28 | + return issueSession(token.userId); |