Update: 2026-06-25 01:15:22

backend/loginWallet.php

@@ -54,11 +54,15 @@ try {
     $stmt->execute([':pid' => $id]);
     $tokenData = $stmt->fetch();
 
-    if (!$tokenData || !hash_equals($tokenData['fingerPrint'], $fingerPrint)) {
-        securityLog("Wallet FP mismatch", ['id' => $id]);
+    if (!$tokenData) {
+        securityLog("Wallet no token row", ['id' => $id]);
         jsonError('Device verification failed', 403);
     }
 
+    // بصمة GCM تتغير في كل مرة (random IV) لذا نحدثها دائماً
+    $updateStmt = $con->prepare('UPDATE tokens SET fingerPrint = :fp WHERE passengerID = :pid');
+    $updateStmt->execute([':fp' => $fingerPrint, ':pid' => $id]);
+
     $limiter->reset(RateLimiter::identifier(), 'login');
 
     $jwtService = new JwtService($redis);