From 79f7e9661cf2b32ab1f4e9a9cf36b2960f90187f Mon Sep 17 00:00:00 2001 From: Christopher Hight Date: Thu, 1 Oct 2026 15:18:08 -0700 Subject: [PATCH] Fix security, we check for broken API calls. --- client/src/store/authStore.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/client/src/store/authStore.js b/client/src/store/authStore.js index 9c8ebde..a7a84f8 100644 --- a/client/src/store/authStore.js +++ b/client/src/store/authStore.js @@ -46,6 +46,11 @@ const useAuthStore = create((set) => ({ // Hit the new lightweight endpoint const res = await api.get('session/'); + // 🔨 Security Fix a broken API call, Verify we actually got a user object back, not HTML fallback text + if (typeof res.data === 'string' || !res.data.username) { + throw new Error("Received invalid data format instead of user session"); + } + // Rehydrate the store with the user's info! set({ isAuthenticated: true,