cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(auth): add server-tracked sessions with view/revoke

Browse Source 
JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.
This commit is contained in:
cesnimda
2026-07-13 01:47:31 +02:00
parent 904f3a8ec8
commit c6918cbeea
17 changed files with 684 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Models/UserSession.cs
+17
View File
@@ -0,0 +1,17 @@
namespace JobTrackerApi.Models;
// Server-side record of a JWT issued via AppSessionIssuer. The JWT carries this row's Id as its
// "sid" claim; Program.cs's "local" JwtBearer OnTokenValidated looks the row up on every request
// so a session can actually be revoked before its JWT naturally expires (previously the JWT alone
// was the credential -- see AppSessionIssuer). Same shape/rationale as TrustedDevice, but this
// tracks the *session* itself rather than a "skip 2FA" cookie.
public sealed class UserSession
{
public string Id { get; set; } = "";
public string UserId { get; set; } = "";
public string? DeviceLabel { get; set; }
public DateTimeOffset CreatedAtUtc { get; set; }
public DateTimeOffset LastSeenAtUtc { get; set; }
public DateTimeOffset ExpiresAtUtc { get; set; }
public DateTimeOffset? RevokedAtUtc { get; set; }
}