[Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry #12

New Issue

wtclaude · 2026-07-02T01:20:45Z

wtclaude commented

2026-07-02 01:20:45 +00:00

Severity: Medium · Type: Security / session

Problem

isLoggedIn (server/src/utils/auth.js:81) trusts id and role straight from the JWT and never re-checks the database. Because the token embeds role and lasts JWT_EXPIRES_IN (default 1d):

A user who is demoted from admin keeps their admin token (old role) until it expires.
A user who is deleted keeps a working session until the token expires.

This partly undermines the "cannot demote/delete the last admin" guards in admin.controller.js:479,505.

Suggested fix

For sensitive routes, load the user from the DB inside isLoggedIn and use the DB role (or add a token/session version claim and compare it to a stored value, bumping it on role change / password reset / delete). The /auth/me handler already re-fetches from the DB — the authorization path should too.

**Severity:** Medium · **Type:** Security / session ## Problem `isLoggedIn` (`server/src/utils/auth.js:81`) trusts `id` and `role` straight from the JWT and never re-checks the database. Because the token embeds `role` and lasts `JWT_EXPIRES_IN` (default `1d`): - A user who is **demoted** from admin keeps their admin token (old role) until it expires. - A user who is **deleted** keeps a working session until the token expires. This partly undermines the "cannot demote/delete the last admin" guards in `admin.controller.js:479,505`. ## Suggested fix For sensitive routes, load the user from the DB inside `isLoggedIn` and use the DB `role` (or add a token/session version claim and compare it to a stored value, bumping it on role change / password reset / delete). The `/auth/me` handler already re-fetches from the DB — the authorization path should too.

wtclaude referenced this issue from a commit

2026-07-03 02:19:22 +00:00

Re-validate JWT against the DB in isLoggedIn (#12)

wtclaude referenced this issue

2026-07-03 02:22:20 +00:00

Enforce role-based authorization on admin-only routes (fixes #10) #15

wtclaude referenced a pull request that will close this issue

2026-07-03 02:23:02 +00:00

Re-validate JWT against the DB in isLoggedIn (fixes #12) #16

whitlocktech closed this issue

2026-07-03 02:32:09 +00:00

whitlocktech referenced this issue from a commit