|
|
ad7ce9dc22
|
Security fix: GM authorized from server-side session via x-session-id header
- New database/auth.js: shared server-side GM check using session store
- database/server.js: crypto-random session generation, server-side session
storage, GM auth from session instead of x-gm-secret header
- database/routes/playerRoutes.js: GM-only endpoints use server-side auth
- database/routes/sessionRoutes.js: session creation/lookup endpoints
- database/routes/bestiaryRoutes.js: GM auth from server-side session
- database/routes/rulesRoutes.js: GM auth from server-side session
- src/App.js: send x-session-id header with API requests
- src/components/BestiaryTab.jsx: use session-based GM auth
|
2026-07-16 23:03:52 +02:00 |
|
