Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix JWT authentication to validate session expiration

Browse Source 
Co-authored-by: stnguyen90 <1477010+stnguyen90@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2025-08-06 03:26:18 +00:00
co-authored by stnguyen90
parent bb5cdd13ea
commit 7e96b07191
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/init/resources.php
+14 -1
View File
@@ -273,8 +273,21 @@ App::setResource('user', function ($mode, $project, $console, $request, $respons
$jwtSessionId = $payload['sessionId'] ?? '';
if (!empty($jwtSessionId)) {
if (empty($user->find('$id', $jwtSessionId, 'sessions'))) { // Match JWT to active token
$session = $user->find('$id', $jwtSessionId, 'sessions');
if (empty($session)) { // Match JWT to active token
$user = new Document([]);
} else {
// Validate session is not expired - check expiration time like Auth::sessionVerify does
$sessionExpire = $session->getAttribute('expire');
if (
empty($sessionExpire) ||
DatabaseDateTime::formatTz(DatabaseDateTime::format(new \DateTime($sessionExpire))) < DatabaseDateTime::formatTz(DatabaseDateTime::now())
) {
$user = new Document([]);
} else {
// Set Auth::unique for consistency with regular session authentication
Auth::$unique = $user->getId();
}
}
}
}