Repository navigation

fix(auth): store refresh tokens only as session hashes - #93

Merged

DJAngel973 merged 1 commit into

mainfrom

fix/sec-003-refresh-token-storage

Oct 26, 2026

Merged

fix(auth): store refresh tokens only as session hashes#93
DJAngel973 merged 1 commit into
mainfrom
fix/sec-003-refresh-token-storage

DJAngel973 commented Oct 26, 2026

Owner

Summary

Removed the raw users.refresh_token storage.
Kept user_sessions.token_hash as the only refresh-session source of truth.
Updated refresh and logout flows to validate and revoke sessions through SHA-256 token hashes.
Added tests for session owenrship and rejection of a stored hash used as a refresh token.
Updated the schema migration and implementation plan.

Verification

./scripts/test.sh -> 112 tests passed. 0 failures, 0 errors.
Docker health check -> 200
Verified register -> refresh -> logout -> rejected refresh reuse (201 -> 200 -> 200 -> 401).


           fix(auth): store refresh tokens only as session hashes

f97a67c

DJAngel973 merged commit ebf825d into main

4 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet