FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix: simple auth tokens no longer expire after 1 hour by melvincarvalho · Pull Request #256 · JavaScriptSolidServer/JavaScriptSolidServer · GitHub

  1. JavaScriptSolidServer
  2. JavaScriptSolidServer

Repository navigation

fix: simple auth tokens no longer expire after 1 hour #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
melvincarvalho merged 3 commits into from
Apr 3, 2026
Conversation 5 Commits 3 Checks 0 Files changed
Merged

fix: simple auth tokens no longer expire after 1 hour #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cacf4f4
fix: simple auth tokens no longer expire after 1 hour
melvincarvalho Apr 3, 2026
08ac1c3
fix: guard expiresIn against falsy values like 0 or NaN
melvincarvalho Apr 3, 2026
eebfcef
docs: mark exp as optional in verifyToken return type
melvincarvalho Apr 3, 2026
File filter

Filter by extension

Filter by extension .js  (2) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
4 changes: 2 additions & 2 deletions src/ap/routes/oauth.js
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ export function createAuthorizePostHandler () {
// Implicit grant (response_type=token) — return token directly in fragment (RFC 6749 §4.2.2)
// Used by remoteStorage clients
if (response_type === 'token') {
const accessToken = createToken(account.webId)
const accessToken = createToken(account.webId, 3600)

// Handle OOB — display token
if (redirect_uri === OOB_REDIRECT) {
Expand Down Expand Up @@ -208,7 +208,7 @@ export function createTokenHandler () {
}

// Generate Bearer token using existing token infrastructure
const accessToken = createToken(authCode.webId)
const accessToken = createToken(authCode.webId, 3600)

return reply.send({
access_token: accessToken,
Expand Down
10 changes: 6 additions & 4 deletions src/auth/token.js
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -39,15 +39,17 @@ const SECRET = getSecret();
/**
* Create a simple token for a WebID
* @param {string} webId - The WebID to create token for
* @param {number} expiresIn - Expiration time in seconds (default 1 hour)
* @param {number} [expiresIn] - Expiration time in seconds (default: no expiry)
* @returns {string} Token string
*/
Comment on lines 39 to 44

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

With createToken() now able to omit exp, the token module’s docs/types should reflect that exp is optional (e.g., the file header comment describing the payload shape and the verifyToken() JSDoc return type currently imply exp is always present). Updating those docs will help avoid confusion for future callers.

Copilot uses AI. Check for mistakes.
export function createToken(webId, expiresIn = 3600) {
export function createToken(webId, expiresIn) {
const payload = {
webId,
iat: Math.floor(Date.now() / 1000),
exp: Math.floor(Date.now() / 1000) + expiresIn
};
if (expiresIn !== undefined && expiresIn > 0) {
payload.exp = Math.floor(Date.now() / 1000) + expiresIn;
}
Comment on lines +45 to +52

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

if (expiresIn) treats 0 (and NaN) as “no expiry”, producing a non-expiring token even though the caller provided an expiresIn value. Consider validating the parameter (e.g., require a finite number and check expiresIn !== undefined / expiresIn > 0) so accidental falsy values can’t silently disable expiration.

Copilot uses AI. Check for mistakes.
Comment on lines +45 to +52

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

expiresIn is treated as “no expiry” unless it’s > 0, which means non-numeric values (e.g., a string, NaN, null) will silently produce a non-expiring token. To avoid accidental non-expiring tokens if a caller ever forwards config/user input, consider validating the type (e.g., typeof expiresIn === 'number' && Number.isFinite(expiresIn) && expiresIn > 0) and otherwise either omit exp explicitly (documented) or throw.

Copilot uses AI. Check for mistakes.

const data = Buffer.from(JSON.stringify(payload)).toString('base64url');
const signature = crypto
Expand All @@ -65,7 +67,7 @@ export function createToken(webId, expiresIn = 3600) {
* JWT tokens (3-part) require async verification via verifyTokenAsync().
*
* @param {string} token - The token to verify
* @returns {{webId: string, iat: number, exp: number} | null} Decoded payload or null
* @returns {{webId: string, iat: number, exp?: number} | null} Decoded payload or null
*/
export function verifyToken(token) {
if (!token || typeof token !== 'string') {
Expand Down
Back | FazBrowse Home | New Git URL