Fix security, we check for broken API calls.

2026-10-01 15:18:08 -07:00
parent feaa1c9f14
commit 79f7e9661c
1 changed files with 5 additions and 0 deletions
@@ -46,6 +46,11 @@ const useAuthStore = create((set) => ({
            // Hit the new lightweight endpoint
            const res = await api.get('session/');

+            // 🔨 Security Fix a broken API call, Verify we actually got a user object back, not HTML fallback text
+            if (typeof res.data === 'string' || !res.data.username) {
+                throw new Error("Received invalid data format instead of user session");
+            }
+
            // Rehydrate the store with the user's info!
            set({
                isAuthenticated: true,