discord-verify - npm Package Compare versions

Comparing version 1.0.3 to 1.1.0

dist/node.d.ts

@@ -1,3 +0,3 @@
-import { R as Request, S as SubtleCryptoImportKeyAlgorithm } from './verify-b4db2f9d.js';
-export { P as PlatformAlgorithm, h as hexStringToBinary, v as verify } from './verify-b4db2f9d.js';
+import { R as Request, S as SubtleCryptoImportKeyAlgorithm } from './verify-60241dbf.js';
+export { P as PlatformAlgorithm, h as hexStringToBinary, v as verify } from './verify-60241dbf.js';
 
@@ -4,0 +4,0 @@ /**

dist/web.d.ts

@@ -1,3 +0,3 @@
-import { R as Request, S as SubtleCryptoImportKeyAlgorithm } from './verify-b4db2f9d.js';
-export { P as PlatformAlgorithm, h as hexStringToBinary, v as verify } from './verify-b4db2f9d.js';
+import { R as Request, S as SubtleCryptoImportKeyAlgorithm } from './verify-60241dbf.js';
+export { P as PlatformAlgorithm, h as hexStringToBinary, v as verify } from './verify-60241dbf.js';
 
@@ -4,0 +4,0 @@ /**

package.json

 {
 	"name": "discord-verify",
-	"version": "1.0.3",
+	"version": "1.1.0",
 	"author": "Ian Mitchell",
@@ -5,0 +5,0 @@ "description": "A library for verifying the authenticity of requests coming from the Discord Interactions API",

src/lib/verify.ts

@@ -119,2 +119,3 @@ import type {
  * @param algorithm - The name of the crypto algorithm to use
+ * @param expirationTime - The time range in which the request is valid
  * @returns Whether the request is valid or not
@@ -126,3 +127,6 @@ */
 	subtleCrypto: SubtleCrypto,
-	algorithm: SubtleCryptoImportKeyAlgorithm | string = PlatformAlgorithm.NewNode
+	algorithm:
+		| SubtleCryptoImportKeyAlgorithm
+		| string = PlatformAlgorithm.NewNode,
+	expirationTime: number = 15 * 60_000
 ) {
@@ -134,3 +138,11 @@ const clone = request.clone();
 
-	return verify(body, signature, timestamp, publicKey, subtleCrypto, algorithm);
+	return verify(
+		body,
+		signature,
+		timestamp,
+		publicKey,
+		subtleCrypto,
+		algorithm,
+		expirationTime
+	);
 }
@@ -146,2 +158,3 @@
  * @param algorithm - The name of the crypto algorithm to use
+ * @param expirationTime - The time range in which the request is valid
  * @returns Whether the request is valid or not
@@ -155,3 +168,6 @@ */
 	subtleCrypto: SubtleCrypto,
-	algorithm: SubtleCryptoImportKeyAlgorithm | string = PlatformAlgorithm.NewNode
+	algorithm:
+		| SubtleCryptoImportKeyAlgorithm
+		| string = PlatformAlgorithm.NewNode,
+	expirationTime: number = 15 * 60_000
 ) {
@@ -162,2 +178,6 @@ if (timestamp == null || signature == null || rawBody == null) {
 
+	if (Math.abs(Date.now() / 1000 - parseInt(timestamp, 10)) > expirationTime) {
+		return false;
+	}
+
 	const key = await getCryptoKey(publicKey, subtleCrypto, algorithm);
@@ -164,0 +184,0 @@ const name = typeof algorithm === "string" ? algorithm : algorithm.name;

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

32527

increased by2.74%

Lines of code

842

increased by5.25%

No dependency changes