paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Merge pull request #287 from the-luap/fix/password-change-iat-timing

Browse Source 
fix: resolve JWT iat timing issue in password change (#263)
This commit is contained in:
Paul Nothaft
2026-04-09 16:00:25 +02:00
committed by GitHub
parent ba1f010166 b1d16670d5
commit c031b1e863
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/adminAuth.js
+6 -1
View File
@@ -135,12 +135,17 @@ router.post('/change-password', [
updated_at: now updated_at: now
}); });
// Issue a new token so the session remains valid after password_changed_at invalidated the old one // Issue a new token so the session remains valid after password_changed_at invalidated the old one.
// Set iat to 1 second after password_changed_at to guarantee the token passes the
// "iat < password_changed_at" check in auth middleware (password_changed_at has ms precision
// but JWT iat is floored to seconds, which can cause the new token to be rejected).
const iatAfterPasswordChange = Math.floor(now.getTime() / 1000) + 1;
const newToken = jwt.sign({ const newToken = jwt.sign({
id: user.id, id: user.id,
username: user.username, username: user.username,
type: 'admin', type: 'admin',
role: user.role_name, role: user.role_name,
iat: iatAfterPasswordChange,
loginTime: Date.now() loginTime: Date.now()
}, process.env.JWT_SECRET, { }, process.env.JWT_SECRET, {
expiresIn: '24h', expiresIn: '24h',