Code Terrier found 1 new issue — 1 security.
Open in Code Terriersrc/auth/session.ts:25+1 −0| 23 | 23 | const token = await findToken(value); |
| 24 | 24 | if (!token) return null; |
| 25 | + return issueSession(token.userId); | |
| 25 | 26 | } |
🔒 An expired token can still open a session.
This path issues a session without checking token expiry. Check token.expiresAt before creating the session.
Suggested change
| 25 | - return issueSession(token.userId); |
| 25 | + if (token.expiresAt <= Date.now()) { |
| 26 | + return null; |
| 27 | + } |
| 28 | + return issueSession(token.userId); |