Add CSRF token for Google accounts

2018-11-15 20:23:17 -06:00 · 2018-11-15 20:23:17 -06:00 · 48526435ad
parent b92542ea35
commit 48526435ad
1 changed files with 4 additions and 0 deletions
--- a/src/invidious.cr
+++ b/src/invidious.cr
@ -155,6 +155,10 @@ before_all do |env|
        client = make_client(YT_URL)
        user = get_user(sid, client, headers, PG_DB, false)

+        challenge, token = create_response(user.email, "sign_out", HMAC_KEY, 1.week)
+        env.set "challenge", challenge
+        env.set "token", token
+
        env.set "user", user
        env.set "sid", sid
      rescue ex