cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(auth): add server-tracked sessions with view/revoke

Browse Source 
JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.
This commit is contained in:
cesnimda
2026-07-13 01:47:31 +02:00
parent 904f3a8ec8
commit c6918cbeea
17 changed files with 684 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
JobTrackerApi/Controllers/TwoFactorController.cs
+4 -2
View File
@@ -28,14 +28,16 @@ public sealed class TwoFactorController : ControllerBase
private readonly JobTrackerContext _db;
private readonly ITwoFactorPendingTokenService _pending;
private readonly IDataProtector _protector;
private readonly IConfiguration _cfg;
public TwoFactorController(UserManager<ApplicationUser> users, ITokenService tokens, JobTrackerContext db, ITwoFactorPendingTokenService pending, IDataProtectionProvider protectionProvider)
public TwoFactorController(UserManager<ApplicationUser> users, ITokenService tokens, JobTrackerContext db, ITwoFactorPendingTokenService pending, IDataProtectionProvider protectionProvider, IConfiguration cfg)
{
_users = users;
_tokens = tokens;
_db = db;
_pending = pending;
_protector = protectionProvider.CreateProtector("totp-secret-v1");
_cfg = cfg;
}
public sealed record PasswordConfirmRequest(string CurrentPassword);
@@ -202,7 +204,7 @@ public sealed class TwoFactorController : ControllerBase
if (!verified) return Unauthorized();
_pending.Resolve(pendingToken, consume: true);
await AppSessionIssuer.IssueAsync(Request, Response, _tokens, user, session.RememberMe, cancellationToken);
await AppSessionIssuer.IssueAsync(Request, Response, _tokens, _db, _cfg, user, session.RememberMe, cancellationToken);
if (request.TrustDevice)
{