Why this matters now: A compromised token cannot be reliably revoked during an infra incident — the exact moment revocation matters most.
Problem / What: In auth.ts:26-40, if the Redis GET jwt_denylist:... throws and the middleware is not strict, it // fail open and proceeds. So during a Redis outage, all revoked tokens (including those explicitly logged out) are accepted. The strict variant exists but is not the default path used by most routes.
Key Challenges: Choosing fail-closed vs availability consciously; if fail-closed, ensuring a Redis blip doesn't log everyone out (e.g., short negative cache / circuit breaker with a safe default).
Acceptance Criteria:
- Behavior under Redis failure is explicit and documented; a test proves revoked tokens are rejected (or the failure mode is deliberately and safely chosen).
- No silent acceptance of a known-revoked
jti.
Relevant files/functions: src/middleware/auth.ts:26-40, src/controllers/authController.ts:99-103, src/services/rateLimitService.ts.
Out of scope: Switching to short-lived access + refresh tokens (separate initiative).
Labels: advanced, security, auth
Why this matters now: A compromised token cannot be reliably revoked during an infra incident — the exact moment revocation matters most.
Problem / What: In
auth.ts:26-40, if the RedisGET jwt_denylist:...throws and the middleware is not strict, it// fail openand proceeds. So during a Redis outage, all revoked tokens (including those explicitly logged out) are accepted. The strict variant exists but is not the default path used by most routes.Key Challenges: Choosing fail-closed vs availability consciously; if fail-closed, ensuring a Redis blip doesn't log everyone out (e.g., short negative cache / circuit breaker with a safe default).
Acceptance Criteria:
jti.Relevant files/functions:
src/middleware/auth.ts:26-40,src/controllers/authController.ts:99-103,src/services/rateLimitService.ts.Out of scope: Switching to short-lived access + refresh tokens (separate initiative).
Labels: advanced, security, auth