Fix: validate loginAfterState on callback handler

sparcs-kaist · Aug 21, 2023 · 0fb2e79 · 0fb2e79
1 parent 4b1b359
commit 0fb2e79
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/src/services/auth.js b/src/services/auth.js
@@ -114,7 +114,10 @@ const sparcsssoHandler = (req, res) => {
 };
 
 const sparcsssoCallbackHandler = (req, res) => {
-  const { state, redirectOrigin, redirectPath } = req.session?.loginAfterState;
+  const loginAfterState = req.session?.loginAfterState;
+  if (!loginAfterState)
+    return res.status(400).send("SparcsssoCallbackHandler : invalid request");
+  const { state, redirectOrigin, redirectPath } = loginAfterState;
   const stateForCmp = req.body.state || req.query.state;
 
   req.session.loginAfterState = undefined;

diff --git a/src/services/auth.replace.js b/src/services/auth.replace.js
@@ -30,7 +30,10 @@ const createUserData = (id) => {
 
 const loginReplaceHandler = (req, res) => {
   const { id } = req.body;
-  const { redirectOrigin, redirectPath } = req.session?.loginAfterState;
+  const loginAfterState = req.session?.loginAfterState;
+  if (!loginAfterState)
+    return res.status(400).send("SparcsssoCallbackHandler : invalid request");
+  const { redirectOrigin, redirectPath } = loginAfterState;
   tryLogin(req, res, createUserData(id), redirectOrigin, redirectPath);
 };