Security: make sure the security key matches up with the user by last TOTP ticket

2026-09-02 02:39:00 +00:00 · 2026-05-06 19:11:09 +02:00
parent 7e152be9dd
commit f89ee5e24a
1 changed files with 1 additions and 0 deletions
@@ -72,6 +72,7 @@ router.post(

        const securityKey = await SecurityKey.findOneOrFail({
            where: {
+                user_id: user.id,
                key_id: Buffer.from(clientAttestationResponse.rawId, "base64url").toString("base64"),
            },
        });