Shorten JWT Expiration Time for Improved Session Management

cjackett commented 2 months ago

Description: The JWT tokens in pages/api/admin-check-login-code.ts are currently set with an expiration date far in the future (2038). This could lead to significant security risks if tokens are compromised, as they remain valid for an extended period, providing attackers with prolonged access. Long-lived tokens are also difficult to revoke, particularly in a stateless JWT system, and hinder the ability to adapt to evolving security practices, such as secret rotation or policy updates.

Short-lived tokens mitigate these risks by minimizing the impact of a compromised token, simplifying token revocation, and ensuring more frequent re-authentication. They also facilitate adaptation to security changes, as users regularly obtain new tokens that comply with the latest standards.

Affected Code:

cookies.set(cookie_name, signed_jwt, { expires: new Date('Tue, 19 Jan 2038 03:14:07 UTC') })

Proposed Solution:

Set a shorter expiration time for JWTs, such as a few hours or days, depending on the application's security requirements.
Implement token rotation to balance security with a seamless user experience.

Impact: This change will reduce the risk associated with long-lived tokens, ensuring that compromised tokens are only valid for a short period, thereby enhancing the overall security of the application.

dsernst commented 2 months ago

Good one!

arianabuilds commented 2 months ago

Entry Summary for HACK SIV @ DEF CON 2024

Thanks again for participating! This submission earned $90.70 from SIV and $64.42 from the Public Vote, for a total of $155.12.

Here's what we noted in our evaluation:

What's interesting about this submission

Being able to revoke individual JWTs better would be good
Protecting admin interface is important for security

What takes away from it

Currently, we've never needed to revoke any JWTs
If we needed to, we could, it would invalidate all, but that's not that big of a deal (having admins sign back in occasionally is ok)
So it's not really a security issue, more of an annoyance issue.

Issue to track getting paid: https://github.com/siv-org/hack.siv.org/issues/10

siv-org / siv