feat(core): Prevent session hijacking (#9057)

2024-04-09 11:20:35 +02:00
parent 5793e5644a
commit 28261047c3
15 changed files with 124 additions and 53 deletions
--- a/packages/cli/src/controllers/invitation.controller.ts
+++ b/packages/cli/src/controllers/invitation.controller.ts
@@ -164,7 +164,7 @@ export class InvitationController {

 		const updatedUser = await this.userRepository.save(invitee, { transaction: false });

-		this.authService.issueCookie(res, updatedUser);
+		this.authService.issueCookie(res, updatedUser, req.browserId);

 		void this.internalHooks.onUserSignup(updatedUser, {
 			user_type: 'email',