Ensure an isRevoked method is used for tokens

Metadata

ID: typescript-express/jwt-not-revoked

Language: TypeScript

Severity: Warning

Category: Security

Description

Consider a method to revoke JWTs, especially when they contain sensitive information, to ensure they remain short-lived.

Learn More

Non-Compliant Code Examples

import { expressjwt } from "express-jwt";

app.get(
  "/protected",
  expressjwt({
    secret: "shhhhhhared-secret",
    algorithms: ["HS256"],
  }),
  function (req, res) {
    if (!req.auth.admin) return res.sendStatus(401);
    res.sendStatus(200);
  }
);

Compliant Code Examples

import { expressjwt as jwt } from "express-jwt";

app.get(
  "/protected",
  jwt({
    secret: "shhhhhhared-secret",
    algorithms: ["HS256"],
    isRevoked: isRevokedCallback,
  }),
  function (req, res) {
    if (!req.auth.admin) return res.sendStatus(401);
    res.sendStatus(200);
  }
);