jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-10 16:04:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate session expiry response

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:50:00 +01:00
parent edd78d2548
commit 3bd2387dc3
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Game/scripts/control_plane_client.gd
+8 -1
View File
@@ -294,6 +294,13 @@ static func is_session_expired(expires_at: String, now_unix: int = -1) -> bool:
return expiry_unix <= current_unix
static func is_valid_session_response(payload: Dictionary) -> bool:
if not payload.has("expires_at") or not payload["expires_at"] is String:
return false
var expires_at := String(payload["expires_at"])
return is_valid_rfc3339_timestamp(expires_at) and not is_session_expired(expires_at)
static func is_valid_rfc3339_timestamp(value: String) -> bool:
if value.is_empty():
return false
@@ -429,7 +436,7 @@ func _on_request_completed(result: HTTPRequest.Result, response_code: int, _head
if operation == "steam_session":
var returned_token := String(payload.get("access_token", ""))
var returned_player_id := String(payload.get("player_id", ""))
if not is_valid_resource_id(returned_player_id) or not is_valid_access_token(returned_token):
if not is_valid_resource_id(returned_player_id) or not is_valid_access_token(returned_token) or not is_valid_session_response(payload):
request_failed.emit(operation, response_code, "invalid session response")
return
player_id = returned_player_id