From 3ca98d6368bc5bda9d80a397fa112c8ec21cf259 Mon Sep 17 00:00:00 2001
From: As9xm <197338912+As9xm@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:21:29 +0300
Subject: [PATCH] fix(auth): enforce timestamp expiry in middleware to prevent
 replay

---
 src/middleware.ts | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/middleware.ts b/src/middleware.ts
index b672d79247..2f746b1c68 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -35,13 +35,16 @@ export async function middleware(request: NextRequest) {
     return NextResponse.next();
   }
 
-  // 其他模式：只验证签名
-  // 检查是否有用户名（非localStorage模式下密码不存储在cookie中）
-  if (!authInfo.username || !authInfo.signature) {
+  if (!authInfo.username || !authInfo.signature || !authInfo.timestamp) {
+    return handleAuthFailure(request, pathname);
+  }
+  if (
+    typeof authInfo.timestamp !== 'number' ||
+    authInfo.timestamp > Date.now() + 300000 ||
+    Date.now() - authInfo.timestamp > 604800000
+  ) {
     return handleAuthFailure(request, pathname);
   }
-
-  // 验证签名（如果存在）
   if (authInfo.signature) {
     const isValidSignature = await verifySignature(
       authInfo.username,