Fix(extension): 익스텐션 로그인 상태 분기 및 토큰 저장 로직 수정 #242
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -69,26 +69,20 @@ export const usePostSignUp = () => { | |
| mutationFn: (data: postSignUpRequest) => postSignUp(data), | ||
| onSuccess: (data) => { | ||
| const newToken = data?.data?.token || data?.token; | ||
|
|
||
| if (newToken) { | ||
| localStorage.setItem('token', newToken); | ||
|
Comment on lines
73
to
74
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: cat -n apps/client/src/shared/apis/queries.ts | sed -n '65,90p'Repository: Pinback-Team/pinback-client Length of output: 899 🏁 Script executed: # Search for httpOnly cookie usage or alternative token storage patterns
rg -i "httponly|http-only|cookie.*secure|document\.cookie" --type ts --type jsRepository: Pinback-Team/pinback-client Length of output: 53 🏁 Script executed: # Check for XSS protection mechanisms like CSP, sanitization, or security headers
rg -i "content-security-policy|csp|sanitize|xss" --type ts --type js --type jsonRepository: Pinback-Team/pinback-client Length of output: 50385 🏁 Script executed: # Search for token storage patterns across the codebase
rg "localStorage.*token|sessionStorage.*token|setItem.*token" --type ts --type js -A 2 -B 2Repository: Pinback-Team/pinback-client Length of output: 2568 🏁 Script executed: # Check if there's any security configuration file or documentation
fd -e "json" -e "ts" -e "js" | xargs grep -l "security\|csrf\|xss" 2>/dev/null | head -20Repository: Pinback-Team/pinback-client Length of output: 113 localStorage 토큰 저장 방식의 보안 위험성 확인 localStorage에 인증 토큰을 저장하는 방식이 정적 분석 결과와 일치합니다. 이는 XSS 공격에 취약한 구조입니다 (CWE-312). JavaScript에 접근 가능한 저장소에 민감한 인증 정보가 저장되므로, 악의적인 스크립트가 토큰을 탈취할 수 있습니다. 현재 아키텍처에서는:
토큰 저장 방식을 보안 기준에 맞게 개선하거나, XSS 방어 메커니즘을 적용하여 이 위험을 완화해야 합니다. 🧰 Tools🪛 ast-grep (0.40.4)[warning] 73-73: Detected potential storage of sensitive information in browser localStorage. Sensitive data like email addresses, personal information, or authentication tokens should not be stored in localStorage as it's accessible to any script. (browser-storage-sensitive-data) |
||
| const sendTokenToExtension = (token: string) => { | ||
| window.postMessage( | ||
| { | ||
| type: 'SET_TOKEN', | ||
| token, | ||
| }, | ||
| window.location.origin | ||
| ); | ||
| }; | ||
| sendTokenToExtension(newToken); | ||
| } | ||
| }, | ||
| onError: (error) => { | ||
| console.error('회원가입 실패:', error); | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,12 @@ | ||
| window.addEventListener('message', (event) => { | ||
| if (event.source !== window) return; | ||
| if (event.data.type === 'SET_TOKEN') { | ||
| chrome.runtime.sendMessage({ | ||
| type: 'SET_TOKEN', | ||
| token: event.data.token, | ||
| }); | ||
| chrome.storage.local.set({ token: event.data.token }, () => { | ||
| console.log('Token saved!', event.data.token); | ||
|
There was a problem hiding this comment. 디버그용 console.log 제거 필요 토큰과 같은 민감한 정보를 콘솔에 출력하지 않도록 해주세요. 🧹 제거 제안- chrome.storage.local.set({ token: event.data.token }, () => {
- console.log('Token saved!', event.data.token);
- });
+ chrome.storage.local.set({ token: event.data.token });
🤖 Prompt for AI Agents |
||
| }); | ||
|
Comment on lines
+8
to
+10
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: find . -name "background.ts" -o -name "content.ts" | head -20Repository: Pinback-Team/pinback-client Length of output: 137 🏁 Script executed: cat -n apps/extension/src/content.tsRepository: Pinback-Team/pinback-client Length of output: 550 🏁 Script executed: cat -n apps/extension/src/background.tsRepository: Pinback-Team/pinback-client Length of output: 903 중복 저장 로직 제거 필요
이는 불필요한 중복입니다. 토큰 저장은 background에서만 담당하도록 통일하세요:
적용 예시 window.addEventListener('message', (event) => {
if (event.source !== window) return;
if (event.data.type === 'SET_TOKEN') {
chrome.runtime.sendMessage({
type: 'SET_TOKEN',
token: event.data.token,
});
- chrome.storage.local.set({ token: event.data.token }, () => {
- console.log('Token saved!', event.data.token);
- });
}
});🤖 Prompt for AI Agents |
||
| } | ||
| }); | ||
|
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
보안: localStorage에 토큰 저장 검토 필요
정적 분석 도구가 올바르게 지적한 것처럼, localStorage에 인증 토큰을 평문으로 저장하는 것은 XSS 공격에 취약합니다(CWE-312). 모든 스크립트가 접근 가능하므로, 악성 스크립트가 토큰을 탈취할 수 있습니다.
다음 대안을 고려해주세요:
🤖 Prompt for AI Agents