Chat auth hardening (#602)

duolicious · Jan 10, 2025 · ee4c656 · ee4c656
1 parent 83abdbb
commit ee4c656
Showing 1 changed file with 12 additions and 2 deletions.
diff --git a/service/chat/__init__.py b/service/chat/__init__.py
@@ -56,8 +56,14 @@ class IntroRateLimit(Enum):
     1
 FROM
     duo_session
+JOIN
+    person
+ON
+    person.id = duo_session.person_id
 WHERE
-    session_token_hash = %(session_token_hash)s
+    duo_session.session_token_hash = %(session_token_hash)s
+AND
+    person.uuid = %(auth_username)s
 """
 
 Q_SELECT_INTRO_HASH = """
@@ -321,7 +327,11 @@ async def process_auth(parsed_xml, username):
 
         auth_token_hash = sha512(auth_token)
 
-        params = dict(session_token_hash=auth_token_hash)
+        params = dict(
+            auth_username=auth_username,
+            session_token_hash=auth_token_hash,
+        )
+
         async with api_tx('read committed') as tx:
             await tx.execute(Q_CHECK_AUTH, params)
             assert await tx.fetchone()