From f2fc1404d4bf50f28aadeb8df43795eddbb14dc4 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Wed, 17 Jun 2026 20:34:14 -0400 Subject: [PATCH] fix(19): IN-01 validate LOCAL_SESSION_EXPIRES coercion (fallback on NaN/non-positive) --- apps/api/src/auth/localSession.ts | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/apps/api/src/auth/localSession.ts b/apps/api/src/auth/localSession.ts index 94ad4bc..39017ec 100644 --- a/apps/api/src/auth/localSession.ts +++ b/apps/api/src/auth/localSession.ts @@ -27,8 +27,15 @@ import type { Context } from 'hono'; // Cookie name must be distinct from the OIDC cookie 'oidc-auth' (Pitfall 4) const COOKIE_NAME = 'local-session'; -// Session max age: default 1 day (86400s); configurable via LOCAL_SESSION_EXPIRES env -const SESSION_MAX_AGE_SECONDS = Number(process.env.LOCAL_SESSION_EXPIRES ?? 86400); +// Session max age: default 1 day (86400s); configurable via LOCAL_SESSION_EXPIRES env. +// IN-01: validate the coercion. A malformed value yields NaN, which would produce a JWT +// with exp = now + NaN (→ NaN) and a cookie maxAge: NaN — making verify behaviour +// "always expired" or "never expires" depending on the lib's NaN handling. Fall back to +// the 86400s default for any non-finite or non-positive value. +const SESSION_MAX_AGE_SECONDS = (() => { + const n = Number(process.env.LOCAL_SESSION_EXPIRES ?? 86400); + return Number.isFinite(n) && n > 0 ? n : 86400; +})(); /** * Issue a signed local-session JWT cookie for the given userId.