fix(auth): sign session cookie to prevent forged-id account takeover

[prashant273000]

Summary

The splitt_session cookie stored the raw user.id, and the auth middleware trusted that value directly to look up the logged-in user. Because user IDs are not secret—they're returned in normal API responses (poster.id, participants[].userId, otherUser.id, getUserById, etc.)—any authenticated user could read another user's ID and replay it as their own cookie to fully impersonate that account.

This PR signs the session cookie so its value can no longer be forged or derived from public data.

Vulnerability

• backend/src/modules/auth/auth.routes.js set the cookie to user.id verbatim, with no signature or encryption.
• backend/src/middleware/auth.js read req.cookies.splitt_session and looked the user up directly, trusting whatever value the client sent.
• httpOnly only prevents JavaScript from reading the cookie (XSS). It does not protect against forged requests.
• An attacker could simply send:

Cookie: splitt_session=<victim-id>

and be authenticated as the victim.

---

Fix

Sign the cookie using cookie-parser's built-in HMAC signing (already a dependency, so no new packages are required).

Changes

app.js

Initialize the parser with a secret:

cookieParser(process.env.SESSION_SECRET)

auth.routes.js

Set both login cookies (/dev-login, /google/token) with:

signed: true

middleware/auth.js

Read from:

req.signedCookies

instead of:

req.cookies

req.signedCookies only returns a value when the cookie's HMAC signature is valid.

.env.example

Document the new environment variable:

SESSION_SECRET=<your-secret-here>

---

Security Impact

A forged cookie:

splitt_session=<some-id>

does not contain a valid signature, so:

req.signedCookies.splitt_session

returns undefined, and the request is treated as unauthenticated.

An attacker cannot generate a valid signature without knowing SESSION_SECRET.

---

Why This Approach

• Zero new dependencies — cookie-parser already provides signing functionality.

---

Files Changed

File	Change
backend/src/app.js	Pass SESSION_SECRET to cookieParser
backend/src/middleware/auth.js	Read from req.signedCookies
backend/src/modules/auth/auth.routes.js	Add signed: true on both login cookies
backend/.env.example	Document SESSION_SECRET

---

Please add a long, random SESSION_SECRET to .env file.

Fixes #18