fix(security): Improve Cloudflare clearance cookie parsing

commit: 063dc5a40f41baa4c9b7c905a1b647d4536726ac
author: Kit · 20mo ago · 2025-02-18 07:32 UTC
parent: c487b81
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

1 file · +3 -2

M src/routes/api/session/login/+server.ts +3 -2


@@ -28,11 +28,12 @@ setInterval(() => {
28	28		}
29	29		}, 60 * 60 * 1000);
30	30
31		-	// cf_clearance:"Qwq0fwt23w"
32	31		// Helper to parse clearance cookie from headers
33	32		function getClearanceCookie(cookieHeader: string \| null): string \| null {
34	33		if (!cookieHeader) return null;
35		-	const match = cookieHeader.match(/cf-clearance=([^;]+)/);
	34	+	// Use a case-insensitive regex to match either "cf-clearance" or "cf_clearance"
	35	+	const regex = /cf[-_]clearance=([^;]+)/i;
	36	+	const match = cookieHeader.match(regex);
36	37		return match ? match[1] : null;
37	38		}
38	39

     }
 }, 60 * 60 * 1000);
-// cf_clearance:"Qwq0fwt23w"
 // Helper to parse clearance cookie from headers
 function getClearanceCookie(cookieHeader: string | null): string | null {
     if (!cookieHeader) return null;
-    const match = cookieHeader.match(/cf-clearance=([^;]+)/);
+    // Use a case-insensitive regex to match either "cf-clearance" or "cf_clearance"
+    const regex = /cf[-_]clearance=([^;]+)/i;
+    const match = cookieHeader.match(regex);
     return match ? match[1] : null;
 }