Security: JWT tokens have no expiry and admin page bypasses authentication

[bilalahmadsheikh]

While exploring the codebase I found two security issues worth discussing:

1. JWT tokens never expire
create_token in worker.py encodes no exp or iat claim.
verify_token never checks expiry. A stolen token is valid forever.

2. Admin page bypasses Basic Auth
wrangler.toml sets run_worker_first = ["/api/*"] only.
Requests to /admin are served directly by Cloudflare Assets,
bypassing the Basic Auth check in _dispatch entirely.

Happy to work on fixes for both if the team confirms these are
in scope. Tagging for discussion before writing any code.

[Shubhashish-Chakraborty]

Hey @bilalahmadsheikh
I've too taken a look at this, and yeah you are right regarding both the vulnerabilities, good catch.
Happy to see you've waited and first started with the discussion before going for a PR.
Just i would suggest: that do mention this on Slack (and also from the next time any of your ideas/discussions on there first) and take suggestions on your next step from there, the community is more active on slack.