Skip to content

done #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
toaru005 merged 1 commit into from
Feb 21, 2026
Merged

done #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Backend/Workspace/Routes/Login.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ router.get(
* - DBからユーザー情報を取得
* - ハッシュ検証後にクッキーを発行
*/
router.post("/Submit", InverseVCM('LOGIN_TOKEN', process.env.LOGIN_SECRET), async (req, res) => {
router.post("/Submit", async (req, res) => {

// 0. 処理開始ログ
console.log("/Login/Submit-API is running!");
Expand Down
11 changes: 11 additions & 0 deletions Backend/Workspace/Routes/Register.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,17 @@ router.post(
parallelism: 1
});

// 4. Cookie発行
CreateCookie({
res,
cookieName: 'LOGIN_TOKEN',
payload: { userId, address: address },
secretKey: process.env.LOGIN_SECRET,
deadlineHours: 24, // 1日有効
Comment on lines +185 to +187
Copy link

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

secretKey: process.env.LOGIN_SECRET can be undefined, which causes jwt.sign inside CreateCookie to throw ("secretOrPrivateKey must have a value"). Consider validating LOGIN_SECRET (similar to the existing PEPPER check) and returning a configuration error before attempting to create the cookie.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inline comment says "1日有効", but CreateCookie currently sets only { httpOnly, sameSite } on the cookie (no maxAge/expires), so the browser cookie itself is session-scoped even though the JWT has a 24h exp. Consider either setting cookie expiration in CreateCookie to match deadlineHours, or adjusting the comment/behavior to avoid confusion.

Suggested change
deadlineHours: 24, // 1日有効
deadlineHours: 24, // JWTは1日有効（Cookie自体はセッション有効）

Copilot uses AI. Check for mistakes.
httpOnly: true,
sameSite: 'strict'
});
Comment on lines +181 to +190
Copy link

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CreateCookie is used here but Register.js does not import it (there are no other references in this file). This will throw ReferenceError: CreateCookie is not defined at runtime; add the appropriate import (matching how Login.js imports it from ../Tools/CreateCookie.js).

Copilot uses AI. Check for mistakes.

Comment on lines +181 to +191
Copy link

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This issues the login cookie before the user record is persisted. If the DB insert fails (or the request errors after cookie issuance), the client can end up holding a valid LOGIN_TOKEN for a userId/address that was never saved. Move cookie issuance to after the DB insert succeeds (and consider clearing any already-set cookie on error paths).

Copilot uses AI. Check for mistakes.

// =====================================================
// 5. DB保存
Expand Down
Loading