Ensure an isRevoked method is used for tokens This product is not supported for your selected
Datadog site . (
).
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter .
TRY THIS RULE ID: javascript-express/jwt-not-revoked
Language: JavaScript
Severity: Warning
Category: Security
CWE : 525
Description Consider a method to revoke JWTs, especially when they contain sensitive information, to ensure they remain short-lived.
Learn More Non-Compliant Code Examples const { expressjwt : jwt } = require ( "express-jwt" )
app . get (
"/protected" ,
jwt ({
secret : "shhhhhhared-secret" ,
algorithms : [ "HS256" ]
}),
function ( req , res ) {
if ( ! req . auth . admin ) return res . sendStatus ( 401 );
res . sendStatus ( 200 );
}
);
import { expressjwt } from "express-jwt" ;
app . get (
"/protected" ,
expressjwt ({
secret : "shhhhhhared-secret" ,
algorithms : [ "HS256" ],
}),
function ( req , res ) {
if ( ! req . auth . admin ) return res . sendStatus ( 401 );
res . sendStatus ( 200 );
}
);
Compliant Code Examples const { expressjwt } = require ( "express-jwt" )
app . get (
"/protected" ,
expressjwt ({
secret : "shhhhhhared-secret" ,
algorithms : [ "HS256" ],
isRevoked : isRevokedCallback ,
}),
function ( req , res ) {
if ( ! req . auth . admin ) return res . sendStatus ( 401 );
res . sendStatus ( 200 );
}
);
import { expressjwt as jwt } from "express-jwt" ;
app . get (
"/protected" ,
jwt ({
secret : "shhhhhhared-secret" ,
algorithms : [ "HS256" ],
isRevoked : isRevokedCallback ,
}),
function ( req , res ) {
if ( ! req . auth . admin ) return res . sendStatus ( 401 );
res . sendStatus ( 200 );
}
);
