@webjsdev/server 0.8.7 → 0.8.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/auth.js

@@ -49,8 +49,13 @@ async function unsign(input, secret) {
   const idx = input.lastIndexOf('.');
   if (idx < 1) return null;
   const value = input.slice(0, idx);
-  const ok = await crypto.subtle.verify('HMAC', await hmacKey(secret), unb64url(input.slice(idx + 1)), enc.encode(value));
-  return ok ? value : null;
+  // `unb64url` -> `atob` throws on non-base64 input. A malformed signature
+  // (a corrupted or attacker-supplied cookie) must read as "not signed by
+  // us", not crash the request. Mirrors the guard in `decodeJwt`.
+  try {
+    const ok = await crypto.subtle.verify('HMAC', await hmacKey(secret), unb64url(input.slice(idx + 1)), enc.encode(value));
+    return ok ? value : null;
+  } catch { return null; }
 }
 
 function randomId() {

package/src/broadcast.js

@@ -55,7 +55,11 @@ export function broadcast(path, data, opts) {
   const msg = typeof data === 'string' ? data : data.toString();
   for (const ws of clients) {
     if (opts?.except && ws === opts.except) continue;
-    if (ws.readyState === 1) ws.send(msg);
+    if (ws.readyState !== 1) continue;
+    // A socket can die between the readyState check and the send (or send
+    // can throw for other reasons). Isolate each send so one dead client
+    // cannot abort the fan-out to everyone after it in the set.
+    try { ws.send(msg); } catch { /* drop this client's frame; close handler removes it */ }
   }
 }