Reject extra session token segments

Author: Autowebassat-blip

apps/logicsrc-web/contract/logicsrc-web.contract.test.ts

@@ -377,6 +377,7 @@ describe("session signing", () => {
     const token = signSession({ provider: "coinpay", sub: "merchant-123" });
     expect(verifySession(token)).toMatchObject({ provider: "coinpay", sub: "merchant-123" });
     expect(verifySession(`${token}tampered`)).toBeNull();
+    expect(verifySession(`${token}.extra`)).toBeNull();
   });
 });
 
@@ -408,6 +409,7 @@ describe("POST /api/webhooks/coinpay", () => {
     const signature = createHmac("sha256", secret).update(`${timestamp}.${payload}`).digest("hex");
 
     expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}`, secret)).toBe(true);
+    expect(verifyCoinPayWebhook(payload, `t=${timestamp}, v1=${signature}`, secret)).toBe(true);
 
     const response = await coinpayWebhook(
       new NextRequest("http://localhost/api/webhooks/coinpay", {

apps/logicsrc-web/src/lib/coinpay.ts

@@ -114,7 +114,7 @@ export function verifyCoinPayWebhook(
   }
 
   try {
-    const parts = signatureHeader.split(",");
+    const parts = signatureHeader.split(",").map((part) => part.trim());
     const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2);
     const signature = parts.find((part) => part.startsWith("v1="))?.slice(3);
     if (!timestamp || !signature) {
@@ -160,7 +160,9 @@ export function signSession(payload: Record<string, unknown>): string {
 }
 
 export function verifySession(value: string): Record<string, unknown> | null {
-  const [encoded, signature] = value.split(".");
+  const parts = value.split(".");
+  if (parts.length !== 2) return null;
+  const [encoded, signature] = parts;
   if (!encoded || !signature) return null;
 
   const expected = createHmac("sha256", getSessionSecret()).update(encoded).digest("base64url");