block reusing tokens

2026-05-28 06:20:14 +00:00 · 2026-03-05 21:38:26 +01:00
parent 15721c6d3a
commit 443593d4fb
1 changed files with 8 additions and 0 deletions
--- a/php/src/Auth/AuthManager.php
+++ b/php/src/Auth/AuthManager.php
@@ -43,6 +43,14 @@ readonly class AuthManager {
            return false;
        }

+        // Prevent token replay: reject tokens that have already been used
+        $tokenHash = hash('sha256', $token);
+        $cacheKey = 'used_token_' . $tokenHash;
+        if (apcu_fetch($cacheKey) !== false) {
+            return false;
+        }
+        apcu_add($cacheKey, true, 60);
+
        return true;
    }