Cookie and Session Security

/help for help, /status for your current setup

cwd: /Users/jeremy/Repos/Claude Code Course/Express-login-demo

> Try "refactor <filepath>"

? for shortcuts
● Update Todos
  ☐ Examine session configuration in server.js
  ☐ Analyze cookie security settings
  ☐ Check for CSRF protection implementation
  ☐ Review session storage configuration
  ☐ Examine route handlers for session security
  ☐ Create structured security findings report

• Let me examine the codebase structure and analyze the session/cookie security implementation.

• Read(server.js)
  └ Read 19 lines (ctrl+r to expand)

• Read(package.json)
  └ Read 25 lines (ctrl+r to expand)

• Search(pattern: "routes/**/*.js")
  └ Found 1 file (ctrl+r to expand)

• Read(routes/auth.js)
  └ Read 98 lines (ctrl+r to expand)

• Read(.env)
  └ Read 10 lines (ctrl+r to expand)

+ Vibing... (esc to interrupt)

// redis-blacklist.js
const redis = require('redis');
const redisClient = redis.createClient();

(async () => {
  await redisClient.connect();
})();

async function isBlacklisted(token) {
  return Boolean(await redisClient.get(`blacklist:${token}`));
}

async function blacklistToken(token, ttlSeconds) {
  // store a key with TTL equal to remaining token lifetime
  await redisClient.setEx(`blacklist:${token}`, ttlSeconds, '1');
}

module.exports = { isBlacklisted, blacklistToken };

// middleware/checkBlacklist.js
const { isBlacklisted } = require('./redis-blacklist');

async function checkBlacklist(req, res, next) {
  const authHeader = req.headers.authorization || '';
  const token = authHeader.split(' ')[1];
  if (!token) return next();

  if (await isBlacklisted(token)) {
    return res.status(401).json({ error: 'Token revoked' });
  }
  next();
}

module.exports = checkBlacklist;

// auth.js (excerpt)
const crypto = require('crypto');
const jwt = require('jsonwebtoken');

// On login:
const accessToken = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '15m' });
const refreshToken = crypto.randomBytes(40).toString('hex');

// Persist refresh token in DB with user id and expiration (and optionally rotate it on use)
await db.saveRefreshToken({ token: refreshToken, userId, expiresAt: Date.now() + 7*24*3600*1000 });

// Send access token in response body, set refresh token as httpOnly, secure cookie:
res.cookie('refresh_token', refreshToken, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'strict',
  maxAge: 7 * 24 * 60 * 60 * 1000
});
res.json({ accessToken });

// POST /auth/refresh
router.post('/refresh', async (req, res) => {
  const refreshToken = req.cookies.refresh_token;
  const record = await db.findRefreshToken(refreshToken);
  if (!record) return res.status(401).end();

  // Optionally: revoke/blacklist the old refresh token, issue a new one
  const newRefreshToken = crypto.randomBytes(40).toString('hex');
  await db.replaceRefreshToken(record.id, newRefreshToken, /* new expiry */);

  const newAccessToken = jwt.sign({ userId: record.userId }, process.env.JWT_SECRET, { expiresIn: '15m' });
  res.cookie('refresh_token', newRefreshToken, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'strict' });
  res.json({ accessToken: newAccessToken });
});

// server.js (excerpt)
const cookieParser = require('cookie-parser');
const csrf = require('csurf');

app.use(cookieParser());

app.use(csrf({ cookie: { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'strict' } }));

// Expose CSRF token to client for single-page apps, over a safe endpoint:
app.get('/csrf-token', (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

// startup checks
const crypto = require('crypto');
if (!process.env.JWT_SECRET || process.env.JWT_SECRET === 'your_jwt_secret_key_here') {
  throw new Error('JWT_SECRET must be set to a strong, random value (not the default).');
}
if (process.env.JWT_SECRET.length < 32) {
  throw new Error('JWT_SECRET must be at least 32 characters long.');
}

const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const redis = require('redis');
const redisClient = redis.createClient();

(async () => { await redisClient.connect(); })();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    sameSite: 'strict',
    maxAge: 24 * 60 * 60 * 1000 // 1 day
  }
}));

router.post('/logout', async (req, res) => {
  const refreshToken = req.cookies.refresh_token;
  if (refreshToken) {
    await db.deleteRefreshToken(refreshToken);
    res.clearCookie('refresh_token', { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'strict' });
  }
  // Optionally blacklist current access token for its remaining lifetime
  const authHeader = req.headers.authorization || '';
  const accessToken = authHeader.split(' ')[1];
  if (accessToken) {
    const decoded = jwt.decode(accessToken);
    if (decoded && decoded.exp) {
      const ttlSeconds = decoded.exp - Math.floor(Date.now() / 1000);
      // blacklistToken(accessToken, ttlSeconds);
    }
  }
  res.status(200).json({ message: 'Logged out' });
});

curl -X POST http://localhost:3000/api/auth/logout \
  -H "Authorization: Bearer eyJ..."
# Expected: 404 Not Found if endpoint is missing.

curl -X GET http://localhost:3000/api/protected \
  -H "Authorization: Bearer eyJ..."
# If this succeeds after a user was removed from the system, revocation isn't implemented.