danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity Actions

Session lifetime: 7 days → 24 hours

Browse source 
Shortens both JWT expiresIn and httpOnly cookie maxAge to 24h in
auth.js (local + register + reset flows) and oidc.js (SSO callback).

Rationale: shorter absolute session window for a PHI-adjacent app.
No sliding idle refresh — user re-logs in once a day.
This commit is contained in:
Daniel 2026-04-14 04:17:54 +02:00
parent cdf178b1c3
commit b294150781
2 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/routes/auth.js
View file

@ -43,7 +43,7 @@ function setAuthCookie(res, token) {
httpOnly: true,
secure: !!isProduction, // HTTPS only in production
sameSite: 'lax', // Allows normal navigation, blocks CSRF from other origins
maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days in ms
maxAge: 24 * 60 * 60 * 1000, // 24 hours in ms
path: '/'
});
}
@ -224,7 +224,7 @@ router.post('/register', async (req, res) => {
var smtpHost = await db.getSetting('smtp.host').catch(function() { return null; }) || process.env.SMTP_HOST;
if (!smtpHost) {
await db.run('UPDATE users SET email_verified = true, verify_token = NULL WHERE id = ?', [userId]);
var token = jwt.sign({ userId: userId }, JWT_SECRET, { expiresIn: '7d' });
var token = jwt.sign({ userId: userId }, JWT_SECRET, { expiresIn: '24h' });
var regSessionId = generateSessionId();
try {
await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)',
@ -345,7 +345,7 @@ router.post('/login', async (req, res) => {
if (!verified) return res.status(401).json({ error: 'Invalid 2FA code' });
}
var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '7d' });
var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '24h' });
await db.run('INSERT INTO audit_log (user_id, action, ip_address) VALUES (?, ?, ?)', [user.id, 'login', req.ip]);
// Create session record

4
src/routes/oidc.js
View file

@ -70,7 +70,7 @@ function setAuthCookie(res, token) {
httpOnly: true,
secure: !!isProduction,
sameSite: 'lax',
maxAge: 7 * 24 * 60 * 60 * 1000,
maxAge: 24 * 60 * 60 * 1000, // 24 hours
path: '/'
});
}
@ -211,7 +211,7 @@ router.get('/oidc/callback', async function(req, res) {
}
// Issue JWT
var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '7d' });
var token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '24h' });
setAuthCookie(res, token);
// Create session record