Severity: Security / Performance
Component: apps/backend (Auth System)
Problem: Currently, the system handles user authentication via JWT tokens using @fastify/jwt. However, there is no active server-side mechanism to invalidate tokens upon logout. If a user logs out, their JWT remains cryptographically valid until its expiration time (exp). An attacker who intercepts this token can continue to make unauthorized API requests even after the legitimate user has clicked "Logout".
Proposed Solution: Implement a secure token revocation layer using the existing Redis infrastructure (redisPlugin).
Create a DELETE /auth/logout endpoint protected by the authenticate preHandler hook.
Upon logout, extract the JWT token signature from the request headers, calculate its remaining lifetime (TTL) based on its expiration timestamp, and store it in Redis with a key like blocklist:token:.
Intercept requests in the global app.decorate('authenticate') middleware hook inside app.ts to check if the incoming token exists in the Redis blocklist. If it does, throw an immediate 401 Unauthorized exception.
Please assign under gssoc 2026
Severity: Security / Performance
Component: apps/backend (Auth System)
Problem: Currently, the system handles user authentication via JWT tokens using @fastify/jwt. However, there is no active server-side mechanism to invalidate tokens upon logout. If a user logs out, their JWT remains cryptographically valid until its expiration time (exp). An attacker who intercepts this token can continue to make unauthorized API requests even after the legitimate user has clicked "Logout".
Proposed Solution: Implement a secure token revocation layer using the existing Redis infrastructure (redisPlugin).
Create a DELETE /auth/logout endpoint protected by the authenticate preHandler hook.
Upon logout, extract the JWT token signature from the request headers, calculate its remaining lifetime (TTL) based on its expiration timestamp, and store it in Redis with a key like blocklist:token:.
Intercept requests in the global app.decorate('authenticate') middleware hook inside app.ts to check if the incoming token exists in the Redis blocklist. If it does, throw an immediate 401 Unauthorized exception.
Please assign under gssoc 2026