jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-13 12:22:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): harden join expiry validation

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:30:36 +01:00
parent 82691eaf80
commit 4d8638e62f
3 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Game/tests/cases/test_match_net.gd
+4
View File
@@ -74,6 +74,10 @@ func test_allocated_join_authorisation_is_allowlisted_and_bound_to_server() -> v
assert_eq(assigned[0]["team"], 1, "assigned roster preserves team")
assert_eq(assigned[0]["slot"], 5, "assigned roster preserves slot")
assert_true(match_net._valid_join_authorisation(token), "allowlisted matching token is accepted")
var malformed_claims := claims.duplicate()
malformed_claims["ExpiresAt"] = "tomorrow"
var malformed_token := Marshalls.raw_to_base64(JSON.stringify({"Authorisation": malformed_claims, "Signature": "trusted-signature"}).to_utf8_buffer())
assert_true(not match_net._valid_join_authorisation(malformed_token), "malformed expiry claim is rejected before admission")
assert_true(not match_net._valid_join_authorisation(token + "tampered"), "token mutation is rejected")
var wrong_claims := claims.duplicate()
wrong_claims["ServerID"] = "other-server"