Demo Authentication Flow Review

**Project:** Express Login Demo  
**Audit Date:** August 20, 2025  
**Auditor:** Security Analysis Tool

## Executive Summary

This security audit analyzed the Express.js login demo application with JWT authentication and PostgreSQL database integration. The audit examined 5 core files and identified several **CRITICAL** and **HIGH** risk vulnerabilities that require immediate attention.

> # Authentication Flow Review

Conduct a comprehensive authentication security review.

Check for:

1. Password hashing
  * Uses `bcrypt.hash()` with salt rounds ≥ 10 (ideally 12); async, not sync; no double-hashing on updates.
  * `bcrypt.compare()` used for login.

2. JWT secret/key strength & storage
  * Secrets/keys not hardcoded; loaded from env or secret manager; separate keys for access vs refresh.
  * Strong entropy (≥256-bit for HS256) or asymmetric (RS256/ES256) with rotation plan.

3. Token settings
  * Access token TTL 5–15 minutes; refresh token TTL 7–30 days; sliding sessions bounded by a max session age.
  * Verify `algorithms`, `issuer (iss)`, `audience (aud)`, `subject (sub)`, `jti`, `iat`, `exp`, and optional `nbf`.

4. Refresh token implementation
  * Rotation on every use and reuse detection (if old RT is presented, revoke the whole session family).
  * RTs stored in HttpOnly, Secure, SameSite cookie; hashed at rest if persisted; per-device tracking.

5. Session invalidation on password change
  * Previously issued tokens rejected after password reset.

6. Brute force protection
  * Rate-limit login/reset/verify endpoints; progressive backoff per username+IP in fast store (e.g., Redis); optional CAPTCHA after threshold.

7. Account enumeration defenses
  * Generic errors and identical timing for user-not-found vs bad-password; optional jitter.

8. Password reset flow security
  * One-time, short-TTL verification tokens; hashed at rest; invalidated after use; no secrets in logs.

9. SQL/NoSQL injection in auth paths
  * Parameterized SQL; no user-controlled operators in filters; query sanitization enabled.

10. AuthZ integrity
  * Roles/permissions loaded server-side; deny-by-default; do not trust JWT claims alone.

11. Cookie & CSRF configuration (if cookies used)
  * `HttpOnly`, `Secure`, `SameSite=Lax|Strict`; narrow `path`/`domain`; explicit `Max-Age`. CSRF protection on state-changing endpoints and refresh route.

12. Input validation & normalization
  * Email/username normalization; length & charset checks; password policy; strong schema validation (zod/joi/celebrate).

13. Mass assignment risks
  * Whitelist allowed fields for updates; cannot set `role`, `emailVerified`, `passwordResetToken`, etc., from `req.body`.

14. JWT misuse
  * Do not use `jwt.decode()` for authorization; always `jwt.verify()` with explicit `algorithms`.

15. Logging & telemetry
  * No logging of passwords, tokens, reset links, or PII; structured logs with redaction.

16. Dependency & crypto hygiene
  * Keep `jsonwebtoken` and `bcrypt` up-to-date; use vetted crypto primitives; do not use MD5/SHA1 for password hashing.

17. Transport & CORS
  * HTTPS enforced; CORS locked to trusted origins; no wildcard credentials.

18. Open redirect / `next` param
  * Restrict post-login redirects to vetted paths/origins.

19. Operational controls
  * Secret rotation procedure; monitoring for suspicious auth patterns; alerting on RT reuse.

Provide:
* Structured finding report (title, severity, CWE, evidence, explanation, exploitability notes, minimal PoC where safe, remediation with precise code/config changes).
* Checklist diff; concrete code locations and minimal drop-in fixes.
* Tests for validation (e.g., RT reuse detection, password-changed invalidation, NoSQLi payload).
* Write final report into audits/ folder.

// routes/auth.js
const bcrypt = require('bcrypt');
const { body, validationResult } = require('express-validator');

router.post(
  '/register',
  [
    body('email').isEmail().normalizeEmail(),
    body('password').isLength({ min: 8, max: 128 })
      .matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&]).+$/)
      .withMessage('Password must contain uppercase, lowercase, number, and special character'),
  ],
  async (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });

    const { email, password, name } = req.body;
    const hashedPassword = await bcrypt.hash(password, 12); // async, salt rounds = 12
    await pool.query(
      'INSERT INTO users (email, name, password) VALUES ($1, $2, $3)',
      [email, name || null, hashedPassword]
    );
    res.status(201).json({ success: true });
  }
);

// middleware/rate-limit.js
const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis'); // optional backed store
const Redis = require('ioredis');

const redisClient = new Redis(process.env.REDIS_URL);

const loginLimiter = rateLimit({
  store: new RedisStore({ sendCommand: (...args) => redisClient.call(...args) }),
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // after 5 failed attempts
  message: { error: 'Too many login attempts, please try again later' },
  standardHeaders: true,
  legacyHeaders: false,
});

router.post('/login', loginLimiter, async (req, res) => {
  // login logic
});

// app.js or a middleware module
app.use((req, res, next) => {
  const proto = req.header('x-forwarded-proto') || req.protocol;
  if (process.env.NODE_ENV === 'production' && proto !== 'https') {
    return res.redirect(`https://${req.header('host')}${req.url}`);
  }
  next();
});

// Inside a try/catch in routes
try {
  // login logic
} catch (error) {
  console.error('Login error:', error); // server-side only
  res.status(500).json({ error: 'Authentication service temporarily unavailable' });
}

const jwt = require('jsonwebtoken');

function verifyAccessToken(token) {
  return jwt.verify(token, process.env.JWT_ACCESS_PUBLIC_OR_SECRET, {
    algorithms: ['HS256'], // or ['RS256'] for asymmetric
    issuer: 'your-service',
    audience: 'your-client',
  });
}

// validation/auth.js
const { body } = require('express-validator');

const registerValidation = [
  body('email').isEmail().isLength({ max: 254 }).normalizeEmail({ gmail_remove_dots: false }),
  body('password')
    .isLength({ min: 8, max: 128 })
    .matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&]).+$/)
    .withMessage('Password must contain uppercase, lowercase, number, and special character'),
];

module.exports = { registerValidation };

// tests/auth-refresh.spec.js
describe('Refresh Token Security', () => {
  it('invalidates session family on token reuse', async () => {
    // 1) obtain refresh token A for device/session 1
    // 2) use refresh token A to get new access + refresh token B (rotation)
    // 3) attempt to use old refresh token A again
    // 4) expect reuse detection: both tokens invalidated, session revoked
  });
});

// tests/brute-force.spec.js
describe('Brute Force Protection', () => {
  it('rate limits after 5 failed attempts', async () => {
    // make 6 login attempts with invalid password
    // expect 6th request returns 429
  });
});