max/GoWeb
1
1
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases 7 Wiki Activity

Make sure a duplicate session token is never stored

Browse Source
This commit is contained in:
max 2022-11-06 10:50:54 -06:00
parent 8f87ee1c4e
commit 35f7cb7601
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
database/models/user.go
View File

@ -132,6 +132,21 @@ func createSessionCookie(app *app.App, w http.ResponseWriter, username string) (
str := hex.EncodeToString(buff) str := hex.EncodeToString(buff)
token := str[:64] token := str[:64]
// Ensure no duplicate tokens exist in database
var count int
err = app.Db.QueryRow("SELECT COUNT(*) FROM sessions WHERE session = $1", token).Scan(&count)
if err != nil {
log.Println("Error querying sessions table for duplicate token")
log.Println(err)
return "", err
}
// If duplicate token found, recursively call function until unique token is generated
if count > 0 {
log.Println("Duplicate token found in sessions table")
return createSessionCookie(app, w, username)
}
// Store token in auth_token column of users table // Store token in auth_token column of users table
sqlStatement := "UPDATE users SET auth_token = $1 WHERE username = $2" sqlStatement := "UPDATE users SET auth_token = $1 WHERE username = $2"
_, err = app.Db.Exec(sqlStatement, token, username) _, err = app.Db.Exec(sqlStatement, token, username)