From 6c98e36511834ad94dcb46650d3eba962c1fa164 Mon Sep 17 00:00:00 2001
From: Daniel <daniel@danvics.com>
Date: Tue, 14 Apr 2026 04:17:54 +0200
Subject: [PATCH] =?UTF-8?q?Session=20lifetime:=207=20days=20=E2=86=92=2024?=
 =?UTF-8?q?=20hours?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Shortens both JWT expiresIn and httpOnly cookie maxAge to 24h in
auth.js (local + register + reset flows) and oidc.js (SSO callback).

Rationale: shorter absolute session window for a PHI-adjacent app.
No sliding idle refresh — user re-logs in once a day.
---
 src/routes/auth.js | 6 +++---
 src/routes/oidc.js | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/routes/auth.js b/src/routes/auth.js
index fcb22e3..42ce2de 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -43,7 +43,7 @@ function setAuthCookie(res, token) {
     httpOnly: true,
     secure: !!isProduction,  // HTTPS only in production
     sameSite: 'lax',         // Allows normal navigation, blocks CSRF from other origins
-    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days in ms
+    maxAge: 24 * 60 * 60 * 1000, // 24 hours in ms
     path: '/'
   });
 }
@@ -224,7 +224,7 @@ router.post('/register', async (req, res) => {
     var smtpHost = await db.getSetting('smtp.host').catch(function() { return null; }) || process.env.SMTP_HOST;
     if (!smtpHost) {
       await db.run('UPDATE users SET email_verified = true, verify_token = NULL WHERE id = ?', [userId]);
-      var token = jwt.sign({ userId: userId }, JWT_SECRET, { expiresIn: '7d' });
+      var token = jwt.sign({ userId: userId }, JWT_SECRET, { expiresIn: '24h' });
       var regSessionId = generateSessionId();
       try {
         await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)',
@@ -345,7 +345,7 @@ router.post('/login', async (req, res) => {
       if (!verified) return res.status(401).json({ error: 'Invalid 2FA code' });
     }
 
-    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '7d' });
+    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '24h' });
     await db.run('INSERT INTO audit_log (user_id, action, ip_address) VALUES (?, ?, ?)', [user.id, 'login', req.ip]);
 
     // Create session record
diff --git a/src/routes/oidc.js b/src/routes/oidc.js
index bcead4d..86f05ca 100644
--- a/src/routes/oidc.js
+++ b/src/routes/oidc.js
@@ -70,7 +70,7 @@ function setAuthCookie(res, token) {
     httpOnly: true,
     secure: !!isProduction,
     sameSite: 'lax',
-    maxAge: 7 * 24 * 60 * 60 * 1000,
+    maxAge: 24 * 60 * 60 * 1000,  // 24 hours
     path: '/'
   });
 }
@@ -211,7 +211,7 @@ router.get('/oidc/callback', async function(req, res) {
     }
 
     // Issue JWT
-    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '7d' });
+    var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '24h' });
     setAuthCookie(res, token);
 
     // Create session record