mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-01 02:27:49 +08:00
b4e4833d2a
This patch will be followed by https://github.com/discourse/discourse/pull/34747. `SecureSession` doesn’t make a lot of sense anymore and can be confusing as the current cookie store used for the session is actually secure since it’s encrypted. Renaming it to `ServerSession` better conveys what it does: providing a session but on the server side only. This patch also makes some improvements, like injecting that server session into Rack-like request objects, allowing the server session to be available virtually everywhere.
21 lines
529 B
Ruby
21 lines
529 B
Ruby
# frozen_string_literal: true
|
|
module DiscourseWebauthn
|
|
class ChallengeGenerator
|
|
class ChallengeSession
|
|
attr_reader :challenge
|
|
|
|
def initialize(params)
|
|
@challenge = params[:challenge]
|
|
end
|
|
|
|
def commit_to_session(server_session, user, expires: server_session.expiry)
|
|
server_session.set(DiscourseWebauthn.session_challenge_key(user), @challenge, expires:)
|
|
self
|
|
end
|
|
end
|
|
|
|
def self.generate
|
|
ChallengeSession.new(challenge: SecureRandom.hex(30))
|
|
end
|
|
end
|
|
end
|
