lnbiuc/blog-next-view

地址https://vio.vin 介绍文章https://vio.vin/article/nuxt-fullstack

Hi 👋, I'm Violet

A Web Developer. Code for Fun.

🚀 Languages and Tools I Use

⚡️ Where to find me

blog-next-view's Issues

Unauthorized Access via Exposed JWT Token in /server/middleware/auth.ts

I have found that the JWT token is leaked in /server/middleware/auth.ts, which can bypass authentication and allow direct modification of information.

By the way,In the backend page /violet, Article and Friends information can be directly accessed by default, potentially leading to unauthorized viewing.

Prove:

自行部署后尝试登录操作会提示 “jwt secretKey is required”

请大佬看看，谢谢！！

当我部署以后尝试登录就会不停提示 jwt secretKey is required

不会用这个MongoDB，以前一直是用的MySQL，尝试提前先创建了一个用户，但依旧会有这个jwt加密的东西报错。

代码中的compress拼写错误

在写图片的cloudflare worker转换脚本时发现图片总是找不到，最后发现如下图所示，代码中的compress 被误拼为了 comporess。

顺便请教一下，这个cloudflare R2存储库读取出的图片您是如何将其转换为适应的长宽的（即添加/compress{1600}x{900}的）鼓捣了一天这个worker也没成功复现动态调整图片大小🤣谢谢！！