21 lines
940 B
Markdown
21 lines
940 B
Markdown
# Iteration Log - 2026-07-24 09:10 - Session Cookie Security
|
|
|
|
**Request**: Configure the authentication token cookie to expire immediately upon browser closure so that users are forced to log in upon reopening the browser.
|
|
|
|
**Affected files**:
|
|
- `backend/routes/auth/helpers.js`
|
|
|
|
## Solution
|
|
|
|
1. **Analysis**:
|
|
- The auth token cookie was configured with `maxAge: 24 * 60 * 60 * 1000` (24 hours).
|
|
- This made it a persistent cookie stored on disk, so reopening the browser sent the cookie and bypassed the login screen.
|
|
|
|
2. **Implementation**:
|
|
- Removed the `maxAge` option from `res.cookie('token', ...)` in `setCookieToken` inside `backend/routes/auth/helpers.js`.
|
|
- The browser now stores the cookie in memory only and discards it when closed (standard session cookie behavior).
|
|
|
|
3. **Deployment**:
|
|
- Deployed successfully using `node scripts/deploy-sftp.js`.
|
|
- PM2 backend service reloaded on the production server.
|