fix(federation): add nonce length validation and fix verification flow docs (FED-008)

2026-03-31 18:18:50 +02:00
parent 9961d9012b
commit d0ed43cf58
2 changed files with 6 additions and 2 deletions
@@ -132,6 +132,9 @@ export function parseFederationHeaders(
  const rawNonce = getHeader('x-federation-nonce') ?? getHeader('X-Federation-Nonce');
  const nonce = rawNonce && typeof rawNonce === 'string' && rawNonce.trim() ? rawNonce.trim() : null;

+  // Reject nonces that are unreasonably long (UUID v4 is 36 chars)
+  if (nonce && nonce.length > 64) return null;
+
  return { origin, timestamp: timestampMs, signature, nonce };
 }