ExternalVendorCode/balena-supervisor
1
0
Fork 0
mirror of https://github.com/balena-os/balena-supervisor.git synced 2024-12-19 13:47:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use buffer-equal-constant-time to evaluate apikey

Browse Source
This commit is contained in:
Pablo Carranza Velez 2016-05-23 23:59:45 -03:00
parent 1780a49030
commit ed7b936fee
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
package.json
View File

@ -9,6 +9,7 @@
"blinking": "~0.0.2",
"bluebird": "^2.9.24",
"body-parser": "^1.12.0",
"buffer-equal-constant-time": "^1.0.1",
"coffee-script": "~1.9.1",
"docker-progress": "^2.0.1",
"dockerode": "~2.2.9",
@ -22,8 +23,8 @@
"pinejs-client": "^1.7.1",
"pubnub": "^3.7.13",
"request": "^2.51.0",
"resin-register-device": "^2.0.0",
"request-progress": "^0.3.1",
"resin-register-device": "^2.0.0",
"rwlock": "^5.0.0",
"sqlite3": "3.0.9",
"typed-error": "~0.1.0"

3
src/api.coffee
View File

@ -4,6 +4,7 @@ utils = require './utils'
knex = require './db'
express = require 'express'
bodyParser = require 'body-parser'
bufferEq = require 'buffer-equal-constant-time'
request = require 'request'
config = require './config'
device = require './device'
@ -24,7 +25,7 @@ module.exports = (application) ->
api.use (req, res, next) ->
utils.getOrGenerateSecret('api')
.then (secret) ->
if req.query.apikey is secret
if bufferEq(new Buffer(req.query.apikey), new Buffer(secret))
next()
else
res.sendStatus(401)