Need

Securely generate session tokens with a shorter lifespan

Context

• Usage of TypeScript for type-checking and compiling JavaScript code
• Usage of Express for building web applications and handling HTTP requests
• Usage of jsonwebtoken for generating and verifying JSON Web Tokens (JWT)

Description

Non compliant code

        import express from 'express';
import jwt from 'jsonwebtoken';

const app = express();

app.post('/login', (req, res) => {
  // Authenticate user and generate token
  const user = {
    id: 1,
    username: 'exampleUser',
    role: 'admin'
  };

  const token = jwt.sign(user, 'secretKey', { expiresIn: '5d' }); // Insecure token lifespan

  res.json({ token });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The vulnerability in this code lies in the insecure generation of session tokens with a long lifespan.

In the code, when a user successfully logs in, a session token is generated using the jwt.sign() function from the jsonwebtoken library. The token is signed with a secret key and has an expiration time set to '5d', which means approximately 5 days.

The impact of this vulnerability is that an attacker who gains access to a valid session token can use it for an extended period of time, potentially allowing them to modify user information or perform unauthorized actions on behalf of the user.

The recommendation to mitigate this vulnerability is to decrease the lifespan of the tokens. By reducing the expiration time, the window of opportunity for an attacker to exploit a stolen or leaked token is significantly reduced. This can help limit the potential damage that can be done using a compromised token.

Steps

• Decrease the lifespan of the token to a shorter duration, such as a few hours or minutes.
• Update the 'expiresIn' option in the jwt.sign() function to use a shorter duration.
• For example, you can use '1h' for 1 hour or '30m' for 30 minutes.

Compliant code

        import express from 'express';
import jwt from 'jsonwebtoken';

const app = express();

app.post('/login', (req, res) => {
  // Authenticate user and generate token
  const user = {
    id: 1,
    username: 'exampleUser',
    role: 'admin'
  };

  const token = jwt.sign(user, 'secretKey', { expiresIn: '1h' }); // Decreased token lifespan to 1 hour

  res.json({ token });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The fixed code addresses the vulnerability by decreasing the lifespan of the session tokens.

In the code, an Express server is created and a route is defined for the '/login' endpoint. When a user successfully authenticates, a token is generated using the jsonwebtoken library.

The user object contains the necessary information such as the user's ID, username, and role. The jwt.sign function is used to generate the token, and the 'secretKey' is used as the signing key. The expiresIn option is set to '1h', which means the token will expire after 1 hour.

By setting a shorter expiration time for the token, the code reduces the window of opportunity for an attacker to leverage a session token to modify user information. This helps to mitigate the impact of the vulnerability.

Finally, the server listens on port 3000 for incoming requests.

Overall, the code fixes the vulnerability by generating tokens with a decreased lifespan, making it more difficult for an attacker to exploit the tokens.

References

• 322. Insecurely generated token - Lifespan