Ensure an isRevoked method is used for tokens

Docs > Code Analysis > Static Analysis Rules > Ensure an isRevoked method is used for tokens

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: typescript-express/jwt-not-revoked

Language: TypeScript

Severity: Warning

Category: Security

CWE: 525

Description

Consider a method to revoke JWTs, especially when they contain sensitive information, to ensure they remain short-lived.

Learn More

ExpressJWT revoking documentation

Non-Compliant Code Examples

import { expressjwt } from "express-jwt";

app.get(
  "/protected",
  expressjwt({
    secret: "shhhhhhared-secret",
    algorithms: ["HS256"],
  }),
  function (req, res) {
    if (!req.auth.admin) return res.sendStatus(401);
    res.sendStatus(200);
  }
);

Compliant Code Examples

import { expressjwt as jwt } from "express-jwt";

app.get(
  "/protected",
  jwt({
    secret: "shhhhhhared-secret",
    algorithms: ["HS256"],
    isRevoked: isRevokedCallback,
  }),
  function (req, res) {
    if (!req.auth.admin) return res.sendStatus(401);
    res.sendStatus(200);
  }
);