Improve tampering tests by altering the first character of the signature for reliable decoding changes

Author: kavindadimuthu

packages/nuxt/tests/unit/session-manager.test.ts

@@ -81,9 +81,11 @@ describe('createSessionToken / verifySessionToken', () => {
       TEST_SECRET,
     );
 
-    // Flip the last character of the signature (third segment)
+    // Flip the first character of the signature — the first char encodes 6 full
+    // data bits, so any change reliably alters the decoded value (unlike the last
+    // char, which only carries 4 data bits and can be a no-op when those bits collide).
     const parts = token.split('.');
-    parts[2] = parts[2].slice(0, -1) + (parts[2].endsWith('a') ? 'b' : 'a');
+    parts[2] = (parts[2][0] === 'a' ? 'b' : 'a') + parts[2].slice(1);
     const tampered = parts.join('.');
 
     await expect(verifySessionToken(tampered, TEST_SECRET)).rejects.toThrow();
@@ -146,7 +148,9 @@ describe('createTempSessionToken / verifyTempSessionToken', () => {
   it('rejects a tampered temp token', async () => {
     const token = await createTempSessionToken('temp-sess-3', TEST_SECRET);
     const parts = token.split('.');
-    parts[2] = parts[2].slice(0, -1) + (parts[2].endsWith('a') ? 'b' : 'a');
+    // Flip the first character of the signature — reliably changes the decoded
+    // value regardless of which character the signature happens to end with.
+    parts[2] = (parts[2][0] === 'a' ? 'b' : 'a') + parts[2].slice(1);
 
     await expect(verifyTempSessionToken(parts.join('.'), TEST_SECRET)).rejects.toThrow();
   });