Harden web session handling and production config

backend/src/app.js

@@ -16,6 +16,7 @@ app.use(helmet());
 app.use(
   cors({
     origin: env.corsOrigin,
+    credentials: true,
   })
 );
 app.use(morgan(env.nodeEnv === 'production' ? 'combined' : 'dev'));

backend/src/config/env.js

@@ -3,6 +3,40 @@ const dotenv = require('dotenv');
 
 dotenv.config({ path: path.resolve(process.cwd(), '.env') });
 
+const requireEnv = (name) => {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+};
+
+if (process.env.NODE_ENV === 'production') {
+  [
+    'JWT_SECRET',
+    'CORS_ORIGIN',
+    'FRONTEND_URL',
+    'DB_HOST',
+    'DB_NAME',
+    'DB_USER',
+    'DB_PASSWORD',
+    'STORAGE_PATH',
+    'MAIL_HOST',
+    'MAIL_PORT',
+    'MAIL_USER',
+    'MAIL_PASS',
+    'MAIL_FROM',
+  ].forEach(requireEnv);
+
+  if (process.env.JWT_SECRET === 'change_me') {
+    throw new Error('JWT_SECRET cannot use the default insecure value in production.');
+  }
+
+  if ((process.env.FRONTEND_URL || '').includes('localhost')) {
+    throw new Error('FRONTEND_URL must not point to localhost in production.');
+  }
+}
+
 const env = {
   port: Number(process.env.PORT) || 4000,
   nodeEnv: process.env.NODE_ENV || 'development',
@@ -50,6 +84,7 @@ const env = {
   },
 
   frontendUrl: process.env.FRONTEND_URL || 'http://localhost:5173',
+  refreshCookieName: process.env.REFRESH_COOKIE_NAME || 'linkedsign_refresh',
   androidApkPath:
     process.env.ANDROID_APK_PATH || path.resolve(process.cwd(), '..', 'android', 'apk', 'LinkedSign-debug.apk'),
 };

backend/src/modules/auth/auth.controller.js

@@ -1,12 +1,41 @@
 const authService = require('./auth.service');
 const usersService = require('../users/users.service');
 const { sendSuccess } = require('../../utils/apiResponse');
+const env = require('../../config/env');
 
 const getContext = (req) => ({
   ip: req.ip?.replace('::ffff:', '') || null,
   userAgent: req.headers['user-agent'] || null,
 });
 
+const getRefreshCookieOptions = () => ({
+  httpOnly: true,
+  secure: env.nodeEnv === 'production',
+  sameSite: 'lax',
+  path: '/',
+  maxAge: 7 * 24 * 60 * 60 * 1000,
+});
+
+const readRefreshToken = (req) => {
+  const cookieHeader = req.headers.cookie || '';
+  const cookies = Object.fromEntries(
+    cookieHeader
+      .split(';')
+      .map((entry) => entry.trim())
+      .filter(Boolean)
+      .map((entry) => {
+        const separatorIndex = entry.indexOf('=');
+        if (separatorIndex === -1) return [entry, ''];
+        return [
+          decodeURIComponent(entry.slice(0, separatorIndex)),
+          decodeURIComponent(entry.slice(separatorIndex + 1)),
+        ];
+      })
+  );
+
+  return cookies[env.refreshCookieName] || req.body?.refreshToken || null;
+};
+
 const register = async (req, res, next) => {
   try {
     if (!req.file) {
@@ -33,6 +62,7 @@ const register = async (req, res, next) => {
 const login = async (req, res, next) => {
   try {
     const result = await authService.login(req.body, getContext(req));
+    res.cookie(env.refreshCookieName, result.refreshToken, getRefreshCookieOptions());
     return sendSuccess(res, result, 200);
   } catch (err) {
     return next(err);
@@ -41,7 +71,8 @@ const login = async (req, res, next) => {
 
 const refresh = async (req, res, next) => {
   try {
-    const result = await authService.refresh(req.body.refreshToken);
+    const result = await authService.refresh(readRefreshToken(req));
+    res.cookie(env.refreshCookieName, result.refreshToken, getRefreshCookieOptions());
     return sendSuccess(res, result, 200);
   } catch (err) {
     return next(err);
@@ -50,7 +81,8 @@ const refresh = async (req, res, next) => {
 
 const logout = async (req, res, next) => {
   try {
-    await authService.logout(req.body.refreshToken);
+    await authService.logout(readRefreshToken(req));
+    res.clearCookie(env.refreshCookieName, getRefreshCookieOptions());
     return sendSuccess(res, { message: 'Logged out.' }, 200);
   } catch (err) {
     return next(err);

backend/src/modules/auth/auth.repository.js

@@ -1,4 +1,7 @@
 const db = require('../../config/db');
+const crypto = require('crypto');
+
+const hashRefreshToken = (token) => crypto.createHash('sha256').update(String(token)).digest('hex');
 
 const ensureSchema = async () => {
   const columns = [
@@ -144,22 +147,25 @@ const updateUnlockToken = async (userId, unlockToken, unlockTokenExpires) => {
 };
 
 const saveRefreshToken = async (userId, token, expiresAt) => {
+  const hashedToken = hashRefreshToken(token);
   await db.execute(
     'INSERT INTO refresh_tokens (user_id, token, expires_at) VALUES (?, ?, ?)',
-    [userId, token, expiresAt]
+    [userId, hashedToken, expiresAt]
   );
 };
 
 const findRefreshToken = async (token) => {
+  const hashedToken = hashRefreshToken(token);
   const [rows] = await db.execute(
-    'SELECT rt.*, u.id as uid, u.email, u.name, u.role, u.is_verified, u.is_active FROM refresh_tokens rt JOIN users u ON rt.user_id = u.id WHERE rt.token = ? AND rt.expires_at > NOW()',
-    [token]
+    'SELECT rt.*, u.id as uid, u.email, u.name, u.role, u.is_verified, u.is_active FROM refresh_tokens rt JOIN users u ON rt.user_id = u.id WHERE rt.token IN (?, ?) AND rt.expires_at > NOW()',
+    [hashedToken, token]
   );
   return rows[0] || null;
 };
 
 const deleteRefreshToken = async (token) => {
-  await db.execute('DELETE FROM refresh_tokens WHERE token = ?', [token]);
+  const hashedToken = hashRefreshToken(token);
+  await db.execute('DELETE FROM refresh_tokens WHERE token IN (?, ?)', [hashedToken, token]);
 };
 
 const deleteUserRefreshTokens = async (userId) => {

backend/src/modules/auth/auth.service.js

@@ -267,6 +267,12 @@ const login = async ({ email, password }, context = {}) => {
 };
 
 const refresh = async (token) => {
+  if (!token) {
+    const err = new Error('Invalid or expired refresh token.');
+    err.statusCode = 401;
+    throw err;
+  }
+
   const record = await authRepository.findRefreshToken(token);
   if (!record) {
     const err = new Error('Invalid or expired refresh token.');
@@ -293,6 +299,7 @@ const refresh = async (token) => {
 };
 
 const logout = async (token) => {
+  if (!token) return;
   await authRepository.deleteRefreshToken(token);
 };
 

backend/src/modules/auth/auth.validator.js

@@ -35,7 +35,7 @@ const loginSchema = Joi.object({
 });
 
 const refreshSchema = Joi.object({
-  refreshToken: Joi.string().required(),
+  refreshToken: Joi.string().optional(),
 });
 
 const changePasswordSchema = Joi.object({