fix(be-030): Add explicit JWT expiry validation in auth middleware

[thisstk]

🔒 Security Fix: JWT Expiry Validation

Issue

#267 BE-030: middleware.rs does not validate JWT expiry — expired tokens are accepted

Severity: 🔴 Critical
Category: Security / Authentication
Labels: backend, auth, security

Problem Statement

The authentication middleware was accepting JWT tokens without validating the exp (expiry) claim against the current time. This allowed expired tokens to continue working indefinitely, creating a significant security vulnerability for the admin API.

Solution

Implemented explicit validation of the JWT exp claim in the auth_middleware function to:

• Verify the token has not expired before accepting the request
• Return a 401 Unauthorized response for expired tokens
• Provide clear error messaging for debugging

Changes

1. Core Fix: JWT Expiry Validation

• File: core/src/auth.rs (lines 797-802)
• Implementation: Added explicit expiry check after JWT decoding

  // Validate JWT expiry claim (BE-030: verify token has not expired)
  let now = now_secs();
  if token_data.claims.exp <= now {
      return Err(AppError::Unauthorized(
          "Token has expired".into(),
      ));
  }

( Closed #267 )

[drips-wave]

@thisstk Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits