jkasun / stack-abuse-express-jwt Goto Github PK

Hey, there's a flow that apparently no-one has noticed yet.
Let say, during login, server is generating authToken and refreshToken and stored refreshToken on database somewhere.

Now acc. to this article, refreshToken can only be removed when user hits /logout endpoint with refreshToken in body, right?! What if user do not logout from application, and just closes the browser. Then, refreshToken is still there in database. Right? And as fas as i know, there's no other way to remove that refreshToken. Meaning it will become a refreshToken that never expires. (now when user go to same site later, user have to login coz authToken already expired)

Worst case scenario: suppose there's xss in application using which attacker's able to steal Tokens, and also user did not logout. Now attacker has the Refresh Token that never expires and auth Token,
He can refresh the auth token with this infinite refreshToken, and will be logged in as victim user forever.

Making request to refresh auth token in every few minutes is not very difficult for hacker, attacker can automate this task easily.

TypeError: Assignment to constant variable.
at /Users/tsm168/nodejs-jwt-concept/auth.js:71:19
at Layer.handle [as handle_request] (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/layer.js:95:5)
at next (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/route.js:137:13)
at Route.dispatch (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/route.js:112:3)
at Layer.handle [as handle_request] (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/layer.js:95:5)
at /Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/index.js:281:22
at Function.process_params (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/index.js:335:12)
at next (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/index.js:275:10)
at /Users/tsm168/nodejs-jwt-concept/node_modules/body-parser/lib/read.js:130:5