From 6ea9503ab24573d26147c60740277deae11f37b3 Mon Sep 17 00:00:00 2001
From: d00f <8052722+DrDoof@users.noreply.github.com>
Date: Tue, 15 Sep 2026 09:37:11 +0200
Subject: [PATCH] httpd: do not accept a session cookie before the first login

session_id is cleared at boot and only a successful login fills it in,
while the uptime counter and last_session_use both start at 0. For the
first SESSION_TIMEOUT seconds after a start, a request carrying an empty
"Cookie: session=" therefore passes is_word_x(session, session_id) and
is treated as logged in, which is enough for /cmd, /config and /upload.

Only look at the cookie once a session has been handed out.
---
 httpd/httpd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd/httpd.c b/httpd/httpd.c
index f87de897..74c11148 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -340,7 +340,7 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p)
 
 	read_reg_timer(&now);
 
-	if (session) {
+	if (session && session_id[0]) {
 		if (now - last_session_use > SESSION_TIMEOUT) {
 			dbg_string("Session expired\n");
 		} else {