feat(auth): harden authentication against token replay#1100
Open
SanidhyaDhangar wants to merge 1 commit into
Open
feat(auth): harden authentication against token replay#1100SanidhyaDhangar wants to merge 1 commit into
SanidhyaDhangar wants to merge 1 commit into
Conversation
Access tokens now carry a unique `jti` (and `iat`). A server-side revocation denylist lets a token be invalidated before its `exp`, so a captured-but-revoked token can no longer be replayed. - Add `token_denylist`: a TTL-bounded, thread-safe, in-memory revocation store with a Redis-swappable interface. - Add `POST /auth/logout` to revoke the caller's current token. - Reject revoked tokens in `get_current_user` with 401. - Tests: replaying a token after logout returns 401; other sessions stay valid; tokens carry a unique jti/iat. Closes imDarshanGK#490
Author
|
Implemented token-replay hardening as discussed: unique jti per token + a server-side denylist, a POST /auth/logout to revoke tokens, and 401 on replay. Tests included and passing. Ready for review — happy to adjust anything |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #490.
A valid access token that gets captured can currently be replayed until it expires, and there's no way to invalidate one early (e.g. on logout). This PR adds a way to revoke individual tokens and rejects revoked ones.
What changed
jti(token id) and aniat(issued-at) claim.token_denylistmodule: a TTL-bounded, thread-safe in-memory store of revokedjtis. Entries are only kept until the token's ownexp, then purged, so memory stays bounded. The interface is small on purpose so it can be backed by Redis later (the project already exposessettings.redis_url) without touching call sites.POST /auth/logoutendpoint that revokes the caller's current token.get_current_usernow rejects any revoked token with401.Behaviour
401 Token has been revoked.jti) are handled gracefully.Tests
Added to
backend/tests/test_auth_endpoints.py(8 passing):jti/iatChecklist
feat/fix/docs/test: short descriptiondocs/CHANGELOG.md