Bind share link sessions to the token's own resource

2026-08-19 02:32:56 +02:00 · 2026-08-17 14:24:21 -04:00
parent c05d2aeafb
commit 0a8b5e46ca
5 changed files with 63 additions and 128 deletions
@@ -164,6 +164,14 @@ export async function exchangeSession(
                )
                .limit(1);
            if (res) {
+                if (res.resourceId !== resource.resourceId) {
+                    return next(
+                        createHttpError(
+                            HttpCode.UNAUTHORIZED,
+                            "Invalid request token"
+                        )
+                    );
+                }
                await createResourceSession({
                    token,
                    resourceId: resource.resourceId,