cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(auth): add server-tracked sessions with view/revoke

Browse Source 
JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.
This commit is contained in:
cesnimda
2026-07-13 01:47:31 +02:00
parent 904f3a8ec8
commit c6918cbeea
17 changed files with 684 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
JobTrackerApi/Program.cs
+18 -5
View File
@@ -286,16 +286,29 @@ builder.Services.AddAuthentication(options =>
return Task.CompletedTask;
},
OnTokenValidated = context =>
OnTokenValidated = async context =>
{
var userId = LocalAuthIdentity.GetRequiredUserId(context.Principal);
if (userId is not null)
if (userId is null)
{
return Task.CompletedTask;
context.Fail("Local tokens must include a subject/nameidentifier claim.");
return;
}
context.Fail("Local tokens must include a subject/nameidentifier claim.");
return Task.CompletedTask;
// Resolve a fresh scoped JobTrackerContext for this one lookup -- OnTokenValidated
// runs outside the request's normal DI-constructor scope, so RequestServices (the
// per-request scope) must be used directly rather than a captured/singleton one.
// Fail closed if the session row is missing/revoked/expired (including tokens
// with no "sid" claim at all -- see LocalSessionValidator for why: every JWT
// issued going forward carries one, so a token without it is either pre-deploy
// (forces a single re-login for anyone already signed in when this ships --
// acceptable, same additive-forward cost the 2FA/trusted-device features on this
// branch already paid) or forged, and either way isn't proof of a live session.
var db = context.HttpContext.RequestServices.GetRequiredService<JobTrackerContext>();
if (!await LocalSessionValidator.IsValidAsync(db, context.Principal, DateTimeOffset.UtcNow))
{
context.Fail("Session has been revoked or expired.");
}
}
};
options.TokenValidationParameters = new TokenValidationParameters