Problems
- No refresh rotation (
auth.controller.ts:304-334): a stolen refresh token stays valid for its full lifetime with no reuse detection; the single stored refreshToken column also logs out all other devices on each login.
User.isActive never enforced: not checked in login, refresh, or the authenticate middleware (auth.middleware.ts) — deactivated accounts keep full access.- Cookie flags hardcoded
sameSite: 'none'; secure: true (auth.controller.ts:179-184, :320-325): silently dropped on plain-HTTP deployments; /auth/refresh and /auth/logout are cookie-authenticated with no CSRF token while SameSite=None permits cross-site sends; logout clears cookies without matching attributes.
Client-side refresh handling is tracked separately in #22.
Problems
auth.controller.ts:304-334): a stolen refresh token stays valid for its full lifetime with no reuse detection; the single storedrefreshTokencolumn also logs out all other devices on each login.User.isActivenever enforced: not checked in login, refresh, or the authenticate middleware (auth.middleware.ts) — deactivated accounts keep full access.sameSite: 'none'; secure: true(auth.controller.ts:179-184,:320-325): silently dropped on plain-HTTP deployments;/auth/refreshand/auth/logoutare cookie-authenticated with no CSRF token while SameSite=None permits cross-site sends; logout clears cookies without matching attributes.Client-side refresh handling is tracked separately in #22.