claudetools/projects/msp-tools/guru-connect/SEC5_SESSION_TAKEOVER_AUDIT.md

SEC-5: Session Takeover Prevention - Security Audit

Status: NEEDS IMPLEMENTATION Priority: CRITICAL Date: 2026-01-17

Audit Findings

Current Authentication Flow

JWT Token Creation (auth/jwt.rs:60-88):

pub fn create_token(
    &self,
    user_id: Uuid,
    username: &str,
    role: &str,
    permissions: Vec<String>,
) -> Result<String> {
    let now = Utc::now();
    let exp = now + Duration::hours(self.expiry_hours);  // Default: 24 hours

    let claims = Claims {
        sub: user_id.to_string(),
        username: username.to_string(),
        role: role.to_string(),
        permissions,
        exp: exp.timestamp(),
        iat: now.timestamp(),
    };

    encode(&Header::default(), &claims, &EncodingKey::from_secret(self.secret.as_bytes()))
}

Token Validation (auth/jwt.rs:90-100):

pub fn validate_token(&self, token: &str) -> Result<Claims> {
    let token_data = decode::<Claims>(
        token,
        &DecodingKey::from_secret(self.secret.as_bytes()),
        &Validation::default(),  // Only validates signature and expiration
    )?;

    Ok(token_data.claims)
}

Vulnerabilities Identified

1. NO TOKEN REVOCATION (CRITICAL)

Problem: Once a JWT is issued, it remains valid until expiration even if:

• User's password is changed
• User's account is disabled/deleted
• Token is suspected to be compromised
• User logs out

Attack Scenario:

1. Attacker steals JWT token (XSS, MITM, leaked credentials)
2. Admin changes user's password
3. Attacker's token still works for up to 24 hours
4. Admin has no way to invalidate the stolen token

Impact: CRITICAL - Stolen tokens cannot be revoked

2. NO IP ADDRESS VALIDATION (HIGH)

Problem: JWT contains no IP binding. Token works from any IP address.

Attack Scenario:

1. User logs in from office (IP: 1.2.3.4)
2. Attacker steals token
3. Attacker uses token from different country (IP: 5.6.7.8)
4. No warning or detection

Impact: HIGH - Cannot detect token theft

3. NO SESSION TRACKING (HIGH)

Problem: No database record of active JWT sessions

Missing Capabilities:

• Cannot list active user sessions
• Cannot see where user is logged in from
• Cannot revoke specific sessions
• No audit trail of session usage

Impact: HIGH - Limited visibility and control

4. NO CONCURRENT SESSION LIMITS (MEDIUM)

Problem: Same token can be used from unlimited locations simultaneously

Attack Scenario:

1. User logs in from home
2. Token is intercepted
3. Attacker uses same token from 10 different IPs
4. System allows all connections

Impact: MEDIUM - Enables credential sharing and theft

5. NO LOGOUT MECHANISM (MEDIUM)

Problem: No way to invalidate token on logout

Current State:

• Frontend likely just deletes token from localStorage
• Token remains valid server-side
• Attacker who cached token can still use it

Impact: MEDIUM - Logout doesn't actually log out

6. LONG TOKEN LIFETIME (MEDIUM)

Problem: 24-hour token expiration is too long for security-critical operations

Best Practice:

• Access tokens: 15-30 minutes
• Refresh tokens: 7-30 days
• Critical operations: Re-authentication

Current: All tokens live 24 hours

Impact: MEDIUM - Extended window for token theft

Recommended Fixes

FIX 1: Token Revocation Blacklist (HIGH PRIORITY)

Implementation: In-memory token blacklist with Redis fallback for production

Create: server/src/auth/token_blacklist.rs

use std::collections::HashSet;
use std::sync::Arc;
use tokio::sync::RwLock;
use chrono::{DateTime, Utc};

/// Token blacklist for revocation
#[derive(Clone)]
pub struct TokenBlacklist {
    tokens: Arc<RwLock<HashSet<String>>>,
}

impl TokenBlacklist {
    pub fn new() -> Self {
        Self {
            tokens: Arc::new(RwLock::new(HashSet::new())),
        }
    }

    /// Add token to blacklist (revoke)
    pub async fn revoke(&self, token: &str) {
        let mut tokens = self.tokens.write().await;
        tokens.insert(token.to_string());
    }

    /// Check if token is revoked
    pub async fn is_revoked(&self, token: &str) -> bool {
        let tokens = self.tokens.read().await;
        tokens.contains(token)
    }

    /// Remove expired tokens (cleanup)
    pub async fn cleanup_expired(&self, jwt_config: &JwtConfig) {
        let mut tokens = self.tokens.write().await;
        tokens.retain(|token| {
            // Try to decode - if expired, remove from blacklist
            jwt_config.validate_token(token).is_ok()
        });
    }
}

Modify: server/src/auth/jwt.rs - Add revocation check

pub fn validate_token(&self, token: &str, blacklist: &TokenBlacklist) -> Result<Claims> {
    // Check blacklist first (fast path)
    if blacklist.is_revoked(token).await {
        return Err(anyhow!("Token has been revoked"));
    }

    let token_data = decode::<Claims>(
        token,
        &DecodingKey::from_secret(self.secret.as_bytes()),
        &Validation::default(),
    )?;

    Ok(token_data.claims)
}

FIX 2: IP Address Validation (MEDIUM PRIORITY)

Approach: Validate but don't enforce (warn on IP change)

Add to JWT Claims:

#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct Claims {
    pub sub: String,
    pub username: String,
    pub role: String,
    pub permissions: Vec<String>,
    pub exp: i64,
    pub iat: i64,
    pub ip: Option<String>,  // ← Add IP address
}

Modify: Token creation to include IP

pub fn create_token(
    &self,
    user_id: Uuid,
    username: &str,
    role: &str,
    permissions: Vec<String>,
    ip_address: Option<String>,  // ← Add parameter
) -> Result<String> {
    let now = Utc::now();
    let exp = now + Duration::hours(self.expiry_hours);

    let claims = Claims {
        sub: user_id.to_string(),
        username: username.to_string(),
        role: role.to_string(),
        permissions,
        exp: exp.timestamp(),
        iat: now.timestamp(),
        ip: ip_address,  // ← Include in token
    };

    encode(&Header::default(), &claims, &EncodingKey::from_secret(self.secret.as_bytes()))
}

Modify: Token validation to check IP

pub fn validate_token_with_ip(&self, token: &str, current_ip: &str, blacklist: &TokenBlacklist) -> Result<Claims> {
    // Check blacklist
    if blacklist.is_revoked(token).await {
        return Err(anyhow!("Token has been revoked"));
    }

    let claims = decode::<Claims>(
        token,
        &DecodingKey::from_secret(self.secret.as_bytes()),
        &Validation::default(),
    )?.claims;

    // Validate IP (warn if changed)
    if let Some(ref original_ip) = claims.ip {
        if original_ip != current_ip {
            tracing::warn!(
                "IP address mismatch for user {}: token IP={}, current IP={} - possible token theft",
                claims.username, original_ip, current_ip
            );
            // Log security event to database
            // In production: Consider requiring re-authentication or blocking
        }
    }

    Ok(claims)
}

FIX 3: Session Tracking (MEDIUM PRIORITY)

Create database table:

CREATE TABLE active_sessions (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    token_hash VARCHAR(64) NOT NULL UNIQUE,  -- SHA-256 of JWT
    ip_address INET NOT NULL,
    user_agent TEXT,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    last_used_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at TIMESTAMPTZ NOT NULL,
    INDEX idx_user_sessions (user_id, expires_at),
    INDEX idx_token_hash (token_hash)
);

Benefits:

• List user's active sessions
• Revoke individual sessions
• See login locations
• Audit trail

FIX 4: Admin Revocation Endpoints (HIGH PRIORITY)

Add API endpoints:

// POST /api/auth/revoke - Revoke own token (logout)
pub async fn revoke_own_token(
    user: AuthenticatedUser,
    State(state): State<AppState>,
    Extension(token): Extension<String>,
) -> Result<StatusCode, StatusCode> {
    state.token_blacklist.revoke(&token).await;
    info!("User {} revoked their own token", user.username);
    Ok(StatusCode::NO_CONTENT)
}

// POST /api/auth/revoke-user/:user_id - Admin revokes all user tokens
pub async fn revoke_user_tokens(
    admin: AuthenticatedUser,
    Path(user_id): Path<Uuid>,
    State(state): State<AppState>,
) -> Result<StatusCode, StatusCode> {
    if !admin.is_admin() {
        return Err(StatusCode::FORBIDDEN);
    }

    // Revoke all tokens for user
    // Requires session tracking table to find user's tokens

    Ok(StatusCode::NO_CONTENT)
}

FIX 5: Refresh Tokens (LOWER PRIORITY - Future Enhancement)

Not implementing immediately - requires significant changes to frontend

Concept:

• Access token: 15 minutes (short-lived)
• Refresh token: 7 days (long-lived, stored securely)
• Use refresh token to get new access token
• Refresh token can be revoked

Implementation Priority

Phase 1 (Day 1-2) - HIGH:

1. Token blacklist (in-memory)
2. Revocation endpoint for logout
3. Admin revocation endpoint

Phase 2 (Day 3) - MEDIUM: 4. IP address validation (warning only) 5. Session tracking table 6. Security event logging

Phase 3 (Future) - LOWER: 7. Refresh token system 8. Concurrent session limits 9. Automatic IP-based revocation

Testing Requirements

After implementation:

• Logout revokes token (subsequent requests fail with 401)
• Admin can revoke user's token
• Revoked token returns "Token has been revoked" error
• IP mismatch logs warning but allows access
• Expired tokens are cleaned from blacklist
• Blacklist survives server restart (if using Redis)

Current Status

Token Validation: Basic (signature + expiration only) Revocation: NOT IMPLEMENTED IP Binding: NOT IMPLEMENTED Session Tracking: NOT IMPLEMENTED Concurrent Limits: NOT IMPLEMENTED

Risk Level: CRITICAL - Stolen tokens cannot be invalidated

---

Audit Completed: 2026-01-17 Next Action: Implement FIX 1 (Token Blacklist) and FIX 4 (Revocation Endpoints)