Last-Minute Patch

Hot off the press. This middleware guards /admin. During an outage of the auth service it let everyone in. The flag names the principle it broke, two words joined by an underscore: ctfbox{<word>_<word>}.

async function requireAdmin(req, res, next) {
  try {
    const user = await authService.lookup(req.cookies.session);
    if (!user.isAdmin) return res.status(403).end();
  } catch (err) {
    log.warn("auth lookup failed, continuing", err);
  }
  next();
}