fave77/pbchess

JWT token not expiring in provided expiryTime (1 day)

Opened this issue ยท 3 comments

Describe the bug ๐Ÿ›
In auth.service.js, the JWT token is issued and it's expiry is set to be 1 day, but even after a day, the person with the old token is still able to modify profile data.

To Reproduce ๐Ÿ”
Steps to reproduce the behavior:

  1. Try to change your account info after a day (ie. after expiryTime of token)
  2. Able to modify profile data

Expected behaviour ๐Ÿ
Instead, one must not be able to modify account data, even after JWT token should have expired

Desktop (please complete the following information): ๐Ÿ’ป

  • Windows 10
  • Firefox
  • 88.0

Additional context ๐Ÿ“
Related code where we create the JWT token is in:

const issueJWT = (user, expiry='1d') => {
const { _id } = user;
const expiresIn = expiry;
const payload = {
id: _id,
iat: Date.now()
};
const signedToken = jsonwebtoken.sign(payload, PRIV_KEY, { expiresIn: expiresIn, algorithm: 'RS256' });
return {
token: 'Bearer ' + signedToken,
expires: expiresIn
}
}

please assign me this issue

@fave77 please assign me I can work on this

@subhangi2731 You are already assigned to #22. Same person will not be assigned multiple issues as of now.