형식이 잘못된 세션 쿠키로 인해 서버 오류가 발생하던 문제와 업로드 중 오류가 무시되거나 무한히 대기하던 문제 등 버그 수정

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lib/server/crypto.ts

@@ -56,12 +56,13 @@ export const issueSessionId = async (length: number, secret: string) => {
 export const verifySessionId = (sessionIdSigned: string, secret: string) => {
   const [sessionIdHex, sessionIdHmac] = sessionIdSigned.split(".");
   if (!sessionIdHex || !sessionIdHmac) return;
-  if (
-    timingSafeEqual(
-      Buffer.from(sessionIdHmac, "hex"),
-      createHmac("sha256", secret).update(Buffer.from(sessionIdHex, "hex")).digest(),
-    )
-  ) {
+
+  const actualHmac = Buffer.from(sessionIdHmac, "hex");
+  const expectedHmac = createHmac("sha256", secret)
+    .update(Buffer.from(sessionIdHex, "hex"))
+    .digest();
+  // `timingSafeEqual` throws if the lengths differ (e.g. malformed hex)
+  if (actualHmac.length === expectedHmac.length && timingSafeEqual(actualHmac, expectedHmac)) {
     return sessionIdHex;
   }
 };