JWT refresh endpoint enables permanent token lifetime (no revocation) #38

New issue

Closed

opened 2026-08-23 05:42:06 +00:00 by nasandre · 2 comments

nasandre commented

2026-08-23 05:42:06 +00:00

Owner

Low

`authController.refresh` accepts any structurally valid token and re-signs it with a fresh 24h expiry — indefinitely, with no rotation, blacklist, or DB state check. A single stolen token can be renewed forever even after password change.

`backend/src/controllers/authController.ts:73-95`

Suggested fix

Short-lived access tokens + refresh-token table (rotation + revoke on password change/logout), or at least refuse refresh for tokens older than N days and validate current `is_active`/`is_gm` from DB when re-signing.

## Low \`authController.refresh\` accepts any structurally valid token and re-signs it with a fresh 24h expiry — indefinitely, with no rotation, blacklist, or DB state check. A single stolen token can be renewed forever even after password change. \`backend/src/controllers/authController.ts:73-95\` ## Suggested fix Short-lived access tokens + refresh-token table (rotation + revoke on password change/logout), or at least refuse refresh for tokens older than N days and validate current \`is_active\`/\`is_gm\` from DB when re-signing.

nasandre added the

Security

label

2026-08-23 05:42:06 +00:00

nasandre commented

2026-08-23 06:18:48 +00:00

Author

Owner

✅ Fixed:

Refresh refuses tokens older than 7 days (iat check) — stolen tokens can't be renewed forever
Re-signs with CURRENT account state fetched from DB; deactivated/missing accounts get 403

✅ **Fixed**: - Refresh refuses tokens older than 7 days (`iat` check) — stolen tokens can't be renewed forever - Re-signs with CURRENT account state fetched from DB; deactivated/missing accounts get 403

nasandre referenced this issue from a commit

2026-08-23 06:55:48 +00:00

Fix issues #30-#40: security hardening, edit mode, mobile nav, transactions

nasandre commented

2026-08-23 06:56:41 +00:00

Author

Owner

✅ Fixed (commit 05b5453) — refresh now: refuses tokens older than 7 days (iat check), re-signs from CURRENT DB state, and returns 403 for deactivated/missing accounts. Combined with #34's middleware change, stolen-token value decays to zero within a week max.

✅ **Fixed** (commit `05b5453`) — refresh now: refuses tokens older than 7 days (iat check), re-signs from CURRENT DB state, and returns 403 for deactivated/missing accounts. Combined with #34's middleware change, stolen-token value decays to zero within a week max.

nasandre closed this issue

2026-08-23 06:56:41 +00:00