Backend half

SerpentRace_Backend/node_modules/cookie-signature/index.js

@@ -8,14 +8,14 @@ var crypto = require('crypto');
  * Sign the given `val` with `secret`.
  *
  * @param {String} val
- * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret
+ * @param {String} secret
  * @return {String}
  * @api private
  */
 
 exports.sign = function(val, secret){
   if ('string' != typeof val) throw new TypeError("Cookie value must be provided as a string.");
-  if (null == secret) throw new TypeError("Secret key must be provided.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
   return val + '.' + crypto
     .createHmac('sha256', secret)
     .update(val)
@@ -24,24 +24,28 @@ exports.sign = function(val, secret){
 };
 
 /**
- * Unsign and decode the given `input` with `secret`,
+ * Unsign and decode the given `val` with `secret`,
  * returning `false` if the signature is invalid.
  *
- * @param {String} input
- * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret
+ * @param {String} val
+ * @param {String} secret
  * @return {String|Boolean}
  * @api private
  */
 
-exports.unsign = function(input, secret){
-  if ('string' != typeof input) throw new TypeError("Signed cookie string must be provided.");
-  if (null == secret) throw new TypeError("Secret key must be provided.");
-  var tentativeValue = input.slice(0, input.lastIndexOf('.')),
-      expectedInput = exports.sign(tentativeValue, secret),
-      expectedBuffer = Buffer.from(expectedInput),
-      inputBuffer = Buffer.from(input);
-  return (
-    expectedBuffer.length === inputBuffer.length &&
-    crypto.timingSafeEqual(expectedBuffer, inputBuffer)
-   ) ? tentativeValue : false;
+exports.unsign = function(val, secret){
+  if ('string' != typeof val) throw new TypeError("Signed cookie string must be provided.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
+  var str = val.slice(0, val.lastIndexOf('.'))
+    , mac = exports.sign(str, secret);
+  
+  return sha1(mac) == sha1(val) ? str : false;
 };
+
+/**
+ * Private
+ */
+
+function sha1(str){
+  return crypto.createHash('sha1').update(str).digest('hex');
+}