added the worst kind of security ever

server/login-service.ts

@@ -15,13 +15,18 @@ const officialUsers: User[] = [
 
 export class LoginService {
   private readonly users: User[];
+  private readonly sessionKey: string;
 
-  constructor(users: User[]) {
+  constructor(users: User[], sessionKey: string) {
     this.users = users;
+    this.sessionKey = sessionKey;
   }
 
   public static officialLoginService(): LoginService {
-    return new LoginService(officialUsers);
+    return new LoginService(
+      officialUsers,
+      Deno.env.get("SESSION_KEY") || "dev-only",
+    );
   }
 
   private async hashMessage(message: string): Promise<string> {
@@ -74,10 +79,21 @@ export class LoginService {
     await ctx.cookies.set("phenix-session", `${maxUnixEpoch}`, {
       maxAge: maxAgesInSecond,
     });
+    await ctx.cookies.set(
+      "phenix-session-sign",
+      await this.shittyHmac(`${maxUnixEpoch}`, this.sessionKey),
+      {
+        maxAge: maxAgesInSecond,
+      },
+    );
   }
 
   async isLoggedIn(ctx: any): Promise<boolean> {
     const expiration = await ctx.cookies.get("phenix-session");
+    const signature = await ctx.cookies.get("phenix-session-sign");
+    if (signature !== (await this.shittyHmac(expiration, this.sessionKey))) {
+      return false;
+    }
     if (!expiration || !/^\d+$/.test(expiration)) {
       return false;
     }