groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-23 09:41:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Merge pull request #5387 from mikiher/fix/refresh-token-auth

Browse source 
Reject refresh tokens on API and WebSocket authentication
This commit is contained in:
advplyr 2026-07-21 18:20:57 -04:00 • committed by GitHub
commit 6458e6d3d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 88 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
server/auth/TokenManager.js
View file

@ -67,6 +67,18 @@ class TokenManager {
})
}
/**
* Whether a decoded JWT payload may authenticate API/socket requests (not refresh-only credentials).
*
* @param {Object} decoded
* @returns {boolean}
*/
static isBearerAccessTokenPayload(decoded) {
if (!decoded?.userId) return false
if (decoded.type === 'refresh') return false
return true
}
/**
* Function to validate a jwt token for a given user
* Used to authenticate socket connections
@ -77,7 +89,9 @@ class TokenManager {
*/
static validateAccessToken(token) {
try {
return jwt.verify(token, TokenManager.TokenSecret)
const decoded = jwt.verify(token, TokenManager.TokenSecret)
if (!TokenManager.isBearerAccessTokenPayload(decoded)) return null
return decoded
} catch (err) {
return null
}
@ -283,7 +297,11 @@ class TokenManager {
done(null, user)
} else {
// JWT based authentication
// JWT based authentication — refresh tokens are only valid at POST /auth/refresh
if (!TokenManager.isBearerAccessTokenPayload(jwt_payload)) {
done(null, null)
return
}
// Check if the jwt is expired
if (jwt_payload.exp && jwt_payload.exp < Date.now() / 1000) {