boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(security): tighten recovery-download grant window (reject stale/non-int/future) 

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat/v1-foundation
boban 2026-06-15 18:36:31 +02:00
parent 57a3dd51b6
commit 5ab665321f
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
routes/web.php
View File

@ -64,7 +64,9 @@ Route::middleware('auth')->group(function () {
// unused grant cannot linger and be replayed later in the session. ->block() below
// serializes racing reads of the grant.
$grantedAt = session()->pull('2fa.download_grant');
abort_unless(is_int($grantedAt) && now()->timestamp - $grantedAt <= 600, 403);
$age = is_int($grantedAt) ? now()->timestamp - $grantedAt : null;
// Valid only within [now-600s, now]: rejects stale, non-timestamp, and future grants.
abort_unless($age !== null && $age >= 0 && $age <= 600, 403);
$codes = AuthFacade::user()->recoveryCodes();