xsser ca6c2394ab fix(security): HMAC-sign session cookie, remove token from cookie ...

Fixes #95 — session cookie was unsigned base64, allowing forgery.

- New _session.ts: shared HMAC-SHA256 sign/verify using Web Crypto API
- Cookie format: base64(payload).base64(hmac(payload, SESSION_SECRET))
- GitHub token no longer stored in cookie
- All endpoints use signed session verification
- Requires SESSION_SECRET env var in Cloudflare Pages settings

2026-03-21 12:43:49 +08:00

1.6 KiB

Raw Blame History

View Raw