Ralksta 3bbec5a4ac 🛡️ Sentinel: [CRITICAL/HIGH] Upgrade token encryption to AES-GCM (#117) ...

Upgraded `encodeAssetId` and `decodeAssetId` to use `aes-256-gcm` (Authenticated Encryption) instead of `aes-256-cbc`.
AES-CBC lacks authentication, leaving it potentially susceptible to padding oracle attacks or ciphertext manipulation.
The new token adds a `v2:` prefix which strictly enforces AES-GCM while supporting legacy fallback for cached urls.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

2026-04-21 22:51:39 +02:00

2.9 KiB

Raw Blame History

View Raw