admin-valentin/AIvoices
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

additional security check when mac_address is included in ws setup

Browse source
This commit is contained in:
akdeb 2025-12-31 17:54:43 +07:00
parent d52f6458c4
commit cf3a4cd07c
3 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
firmware-arduino/src/Audio.cpp
View file

@ -363,7 +363,9 @@ void webSocketEvent(WStype_t type, const uint8_t *payload, size_t length)
// wifiTask -> WIFIMANAGER::loop() -> WIFIMANAGER::tryConnect() -> connectCb() -> websocketSetup() // wifiTask -> WIFIMANAGER::loop() -> WIFIMANAGER::tryConnect() -> connectCb() -> websocketSetup()
void websocketSetup(const String& server_domain, int port, const String& path) void websocketSetup(const String& server_domain, int port, const String& path)
{ {
const String headers = "Authorization: Bearer " + String(authTokenGlobal); const String headers =
"Authorization: Bearer " + String(authTokenGlobal) + "\r\n" +
"mac_address: " + WiFi.macAddress() + "\r\n";
xSemaphoreTake(wsMutex, portMAX_DELAY); xSemaphoreTake(wsMutex, portMAX_DELAY);

13
server-deno/main.ts
View file

@ -121,7 +121,11 @@ server.on("upgrade", async (req, socket, head) => {
let supabase: SupabaseClient; let supabase: SupabaseClient;
let authToken: string; let authToken: string;
try { try {
const { authorization: authHeader, "x-wifi-rssi": rssi } = req.headers; const {
authorization: authHeader,
"x-wifi-rssi": rssi,
mac_address,
} = req.headers;
authToken = authHeader?.replace("Bearer ", "") ?? ""; authToken = authHeader?.replace("Bearer ", "") ?? "";
const wifiStrength = parseInt(rssi as string); // Convert to number const wifiStrength = parseInt(rssi as string); // Convert to number
@ -137,6 +141,13 @@ server.on("upgrade", async (req, socket, head) => {
supabase = getSupabaseClient(authToken as string); supabase = getSupabaseClient(authToken as string);
user = await authenticateUser(supabase, authToken as string); user = await authenticateUser(supabase, authToken as string);
const expectedMac = user.device?.mac_address;
if (mac_address && mac_address !== expectedMac) {
socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
socket.destroy();
return;
}
} catch (_e: any) { } catch (_e: any) {
socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n"); socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
socket.destroy(); socket.destroy();

2
server-deno/supabase.ts
View file

@ -23,7 +23,7 @@ export const getUserByEmail = async (
email: string, email: string,
): Promise<IUser> => { ): Promise<IUser> => {
const { data, error } = await supabase.from("users").select( const { data, error } = await supabase.from("users").select(
"*, language:languages(name), personality:personalities!users_personality_id_fkey(*), device:device_id(is_reset, is_ota, volume)", "*, language:languages(name), personality:personalities!users_personality_id_fkey(*), device:device_id(is_reset, is_ota, volume, mac_address)",
).eq("email", email); ).eq("email", email);
console.log("data", data, error); console.log("data", data, error);