Harden web session handling and production config

backend/src/modules/auth/auth.service.js

@@ -267,6 +267,12 @@ const login = async ({ email, password }, context = {}) => {
 };
 
 const refresh = async (token) => {
+  if (!token) {
+    const err = new Error('Invalid or expired refresh token.');
+    err.statusCode = 401;
+    throw err;
+  }
+
   const record = await authRepository.findRefreshToken(token);
   if (!record) {
     const err = new Error('Invalid or expired refresh token.');
@@ -293,6 +299,7 @@ const refresh = async (token) => {
 };
 
 const logout = async (token) => {
+  if (!token) return;
   await authRepository.deleteRefreshToken(token);
 };