Giter VIP home page Giter VIP logo

huanghanzhilian / c-shopping Goto Github PK

View Code? Open in Web Editor NEW
1.6K 1.6K 214.0 66.46 MB

A beautiful shopping platform developed with Next.js, tailored for various devices including Desktop, Tablet, and Phone. 基于Nextjs开发同时适配Desktop、Tablet、Phone多种设备的精美购物平台

Home Page: http://shop.huanghanlian.com/

License: MIT License

CSS 1.07% JavaScript 98.66% Shell 0.05% Dockerfile 0.22%
commitlint docker eslint headlessui husky joi jwt lint-staged mongodb mongoose nextjs nextjs14 prettier redux rtk-query tailwindcss

c-shopping's Issues

ETA on english version

First of all, amazing project, and very generous of you to make it open source, I want to use to learn best practices , I was wondering you metnioned you are working on a english version, Is there an ETA, or is it currently on the back burner.

JWT密钥硬编码可能导致任意用户登录

在.env文件 里JWT Token硬编码。

c-shopping/.env

Line 3 in 1588741

NEXT_PUBLIC_ACCESS_TOKEN_SECRET=h1n0U6LHJtCZuWitwjn3oLd5qCRIgUFtemnjTrpfZLzVZ3ff0f

以 http://shop.huanghanlian.com/ 为例，可以任意构造一个合法的JWT。

image

JWT里由userid组成，userid是MongoDB的ObjectID， Object ID可以预测，见 https://book.hacktricks.xyz/v/cn/network-services-pentesting/27017-27018-mongodb#mongo-objectid-yu-ce 。

修复建议：

  • 不使用硬编码的JWT密钥，项目初始化时随机生成

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.