Set Expiration and Renewal Policies for JWTs Generated by the External System

[AliSMAmin]

Discovery:

JWT tokens used for authentication in LibreChat need to have an appropriate expiration policy to ensure security and prevent unauthorized access. Tokens that last too long increase the risk of misuse, while tokens that expire too quickly may disrupt the user experience. Additionally, a token renewal mechanism may be required to extend a session without forcing users to reauthenticate frequently.

Problem Definition:

The external system currently generates JWT tokens for authentication, but it does not enforce an explicit expiration policy or provide a mechanism for renewing tokens. Without these, tokens may remain valid indefinitely, posing a security risk, or users may need to log in again after each token expires, negatively affecting the user experience.

Motivations:

By setting proper expiration and renewal policies for JWT tokens, we will:

• Enhance security by ensuring tokens expire after a reasonable period, limiting the window for misuse.
• Provide a seamless user experience by allowing tokens to be renewed via a secure endpoint, extending session duration without requiring reauthentication.
• Ensure that token expiration aligns with security best practices while balancing user convenience.

Proposed Solution:

1. Set Token Expiration Policy:

   • Define a default expiration period for the JWT tokens (e.g., 24 hours). This means that after 24 hours, the token will no longer be valid, and the user will need to renew or reauthenticate.
   • The expiration (exp) claim should be added to the JWT payload, specifying the exact time at which the token will expire. This will be used to enforce token expiration on the LibreChat side.

2. Implement Token Renewal Endpoint:

   • Create a secure endpoint in the external system to handle token renewal. This endpoint will allow clients to exchange a valid but soon-to-expire token for a new one without requiring full reauthentication.
   • Ensure that the renewal process only works if the current token is still valid (i.e., not expired) and that the new token is issued with a fresh expiration period (e.g., another 24 hours).
   • Consider requiring the user’s refresh_token or other secure mechanism to prevent misuse of the renewal process.

3. Grace Period for Expired Tokens (Optional):

   • Optionally, introduce a grace period after the token has expired where the user can still renew the token without logging in again. This can help prevent user frustration caused by accidental session expiration.

4. Security Considerations:

   • Ensure that the expiration policy is set according to security best practices. Shorter expiration periods are generally more secure, but they must be balanced with user convenience.
   • Ensure tokens are signed with a secure algorithm (e.g., HS256, RS256) and verify the signature during both authentication and renewal processes.
   • Store any refresh_token or related sensitive information securely, using encryption if necessary.

Definition of Done:

• [ ] JWT tokens are issued with an exp claim that expires after a reasonable period (e.g., 24 hours).
• [ ] A secure token renewal endpoint is implemented, allowing clients to renew tokens before they expire.
• [ ] Proper security checks are implemented to validate tokens and prevent misuse of the renewal process.
• [ ] Expired tokens are rejected for authentication, but if a renewal policy is in place, the system will allow tokens to be renewed within the grace period (optional).
• [ ] Test cases are added to ensure tokens expire correctly and that the renewal process works as expected.

Additional Information:

• Documentation: Update internal and external documentation to describe the expiration policy and how token renewal should be handled.
• Testing: Ensure tests cover token expiration, invalid token handling, and renewal scenarios to verify that the security and functionality work as expected.
• Monitoring: Use logging and monitoring tools (e.g., CloudWatch) to track token expirations and renewal attempts for auditing and debugging.

[tomasvalererealms]

time 1

Update of the JWT creation scripts (they were using a too short exp time)