marty/instantadpay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sign-up: hand out the device cookie on every code-request response, including guard refusals

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-16 14:40:54 -05:00
parent 34c62b9d3a
commit aab18e28ca
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server.js
+3 -3
View File
@@ -1230,15 +1230,15 @@ const server = http.createServer(async (req, res) => {
const devHdr = fraud.deviceOf(req) ? undefined : { 'Set-Cookie': fraud.deviceCookie(fraud.newDeviceId(), IS_PROD) }; // browser id for one-account-per-person checks const devHdr = fraud.deviceOf(req) ? undefined : { 'Set-Cookie': fraud.deviceCookie(fraud.newDeviceId(), IS_PROD) }; // browser id for one-account-per-person checks
if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)) return json(res, 400, { error: 'That email address does not look right.' }); if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)) return json(res, 400, { error: 'That email address does not look right.' });
const prev = emailCodes.get(e); const prev = emailCodes.get(e);
if (prev && Date.now() < prev.nextAt) { console.log('signup-guard cooldown', clientIp(req), e.replace(/^(.).*(@.*)$/, '$1***$2')); return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' }); } if (prev && Date.now() < prev.nextAt) { console.log('signup-guard cooldown', clientIp(req), e.replace(/^(.).*(@.*)$/, '$1***$2')); return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' }, devHdr); }
const guard = codeGuard(req, b); // honeypot, form age, per-IP + global limits, icon check once limited const guard = codeGuard(req, b); // honeypot, form age, per-IP + global limits, icon check once limited
if (guard) return json(res, guard.status, guard.body); if (guard) return json(res, guard.status, guard.body, devHdr);
const code = String(Math.floor(100000 + Math.random() * 900000)); const code = String(Math.floor(100000 + Math.random() * 900000));
emailCodes.set(e, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 }); emailCodes.set(e, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 });
if (mailer.hasKey()) { if (mailer.hasKey()) {
try { await mailer.sendCode(e, code); } catch (err) { try { await mailer.sendCode(e, code); } catch (err) {
console.error('sendCode failed', err.message); console.error('sendCode failed', err.message);
return json(res, 502, { error: 'Could not send the email. Try again in a minute.' }); return json(res, 502, { error: 'Could not send the email. Try again in a minute.' }, devHdr);
} }
return json(res, 200, { ok: true, sent: true }, devHdr); return json(res, 200, { ok: true, sent: true }, devHdr);
} }