Hamza/intaleq_v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security:2 Fix HMAC handshake, generate API keys in Google Login, and relax JWT issuer

Browse Source
This commit is contained in:
Hamza-Ayed
2026-04-24 16:28:11 +03:00
parent 392e37c198
commit 2540bef154
2 changed files with 48 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
app/Http/Controllers/AuthController.php
View File

@@ -120,17 +120,24 @@ class AuthController extends Controller
$request->validate([
'phone' => 'required|string',
'email' => 'required|email',
'password' => 'required|string|min:6',
'first_name' => 'required|string',
'last_name' => 'required|string',
'gender' => 'required|string',
'birthdate' => 'required|string',
'site' => 'required|string',
'fingerprint' => 'required|string',
'fcm_token' => 'required|string',
'password' => 'nullable|string|min:6',
'gender' => 'nullable|string',
'birthdate' => 'nullable|string',
'site' => 'nullable|string',
'fingerprint' => 'nullable|string',
'fcm_token' => 'nullable|string',
]);
$phone = $request->input('phone');
$password = $request->input('password', Str::random(12));
$gender = $request->input('gender', 'not_specified');
$birthdate = $request->input('birthdate', '2000-01-01');
$site = $request->input('site', 'none');
$fingerprint = $request->input('fingerprint', 'unknown');
$fcmToken = $request->input('fcm_token', 'none');
$encryptedPhone = $this->encryption->encrypt($phone);
// Check if already exists
@@ -155,12 +162,14 @@ class AuthController extends Controller
'site' => $request->input('site'),
]);
// Create FCM token record
PassengerToken::create([
'token' => $this->encryption->encrypt($request->input('fcm_token')),
'passengerID' => $passengerId,
'fingerPrint' => $request->input('fingerprint'),
]);
// Create FCM token record if provided
if ($fcmToken !== 'none') {
PassengerToken::create([
'token' => $this->encryption->encrypt($fcmToken),
'passengerID' => $passengerId,
'fingerPrint' => $fingerprint,
]);
}
// Generate API keys
$this->generateApiKeys($passenger);
@@ -858,10 +867,12 @@ class AuthController extends Controller
return $this->failure('Invalid credentials');
}
// Verify fingerprint matches stored device (security)
// Verify fingerprint matches stored device (security) - Relaxed for new devices/installs
$token = PassengerToken::where('passengerID', $request->input('id'))->first();
if (!$token || !hash_equals($token->fingerPrint ?? '', $request->input('fingerPrint'))) {
return $this->failure('Device verification failed', 403);
if ($token && $token->fingerPrint && !hash_equals($token->fingerPrint, $request->input('fingerPrint'))) {
\Log::warning("Handshake: Device verification failed for ID: " . $request->input('id'));
// Still allow handshake for now but log it, or return failure if strictness is desired
// return $this->failure('Device verification failed', 403);
}
// Generate a 15min JWT for the handshake (security: reduced from 24h)