jkasun / stack-abuse-express-jwt Goto Github PK
View Code? Open in Web Editor NEWHandling Authorization in Express.js using JWT
Handling Authorization in Express.js using JWT
Hey, there's a flow that apparently no-one has noticed yet.
Let say, during login, server is generating authToken and refreshToken and stored refreshToken on database somewhere.
Now acc. to this article, refreshToken can only be removed when user hits /logout endpoint with refreshToken
in body, right?! What if user do not logout from application, and just closes the browser. Then, refreshToken is still there in database. Right? And as fas as i know, there's no other way to remove that refreshToken. Meaning it will become a refreshToken that never expires. (now when user go to same site later, user have to login coz authToken already expired)
Worst case scenario: suppose there's xss in application using which attacker's able to steal Tokens, and also user did not logout. Now attacker has the Refresh Token that never expires and auth Token,
He can refresh the auth token with this infinite refreshToken, and will be logged in as victim user forever.
Making request to refresh auth token in every few minutes is not very difficult for hacker, attacker can automate this task easily.
TypeError: Assignment to constant variable.
at /Users/tsm168/nodejs-jwt-concept/auth.js:71:19
at Layer.handle [as handle_request] (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/layer.js:95:5)
at next (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/route.js:137:13)
at Route.dispatch (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/route.js:112:3)
at Layer.handle [as handle_request] (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/layer.js:95:5)
at /Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/index.js:281:22
at Function.process_params (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/index.js:335:12)
at next (/Users/tsm168/nodejs-jwt-concept/node_modules/express/lib/router/index.js:275:10)
at /Users/tsm168/nodejs-jwt-concept/node_modules/body-parser/lib/read.js:130:5
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.