Upload 34 files

package.json

@@ -17,7 +17,6 @@
     "bcryptjs": "^2.4.3",
     "cloudinary": "^2.5.1",
     "compression": "^1.7.4",
-    "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.19.2",

src/app.js

@@ -1,7 +1,6 @@
 const express = require("express");
 const helmet = require("helmet");
 const cors = require("cors");
-const cookieParser = require("cookie-parser");
 const compression = require("compression");
 const morgan = require("morgan");
 const mongoSanitize = require("express-mongo-sanitize");
@@ -41,8 +40,18 @@ app.use(
   })
 );
 
-// --- CORS: only the configured frontend origins may call the API, and
-// credentials (refresh-token cookie) are only sent to those origins. ---
+// --- CORS: only the configured frontend origins may call the API.
+// `credentials: false` is deliberate — this API is designed to run
+// cross-site from its frontend (e.g. a Hugging Face Space backend +
+// a separate Vercel-hosted frontend), and some hosting proxies in that
+// kind of setup intercept CORS preflight requests before they reach
+// this app and strip the Access-Control-Allow-Credentials header,
+// which silently breaks anything relying on `credentials: include`.
+// Sessions are carried via a bearer access token (Authorization
+// header) plus a refresh token returned in the JSON response body
+// instead of a cookie, so no cross-site credentialed request is ever
+// needed — see controllers/auth.controller.js for the reasoning and
+// trade-offs of that approach in more detail. ---
 app.use(
   cors({
     origin(origin, callback) {
@@ -54,14 +63,13 @@ app.use(
       logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
       return callback(new Error("Not allowed by CORS"));
     },
-    credentials: true,
+    credentials: false,
   })
 );
 
 app.use(compression());
 app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
 app.use(express.urlencoded({ extended: true, limit: "100kb" }));
-app.use(cookieParser(env.cookieSecret));
 
 // Strip any keys starting with "$" or containing "." from user input to
 // block MongoDB operator-injection attacks.

src/config/env.js

@@ -8,7 +8,6 @@ const REQUIRED_IN_PRODUCTION = [
   "JWT_ACCESS_SECRET",
   "JWT_REFRESH_SECRET",
   "FIELD_ENCRYPTION_KEY",
-  "COOKIE_SECRET",
   "SMTP_HOST",
   "SMTP_USER",
   "SMTP_PASS",
@@ -33,8 +32,6 @@ const env = {
   jwtRefreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || "7d",
 
   fieldEncryptionKey: process.env.FIELD_ENCRYPTION_KEY,
-  cookieSecret: process.env.COOKIE_SECRET,
-  cookieSecure: process.env.COOKIE_SECURE === "true",
 
   smtp: {
     host: process.env.SMTP_HOST,

src/controllers/auth.controller.js

@@ -1,22 +1,34 @@
 const User = require("../models/User");
 const AuditLog = require("../models/AuditLog");
 const { signAccessToken, signRefreshToken, verifyRefreshToken } = require("../utils/jwt");
-const { env } = require("../config/env");
 const logger = require("../utils/logger");
 
 const MAX_FAILED_ATTEMPTS = 5;
 const LOCK_DURATION_MS = 15 * 60 * 1000; // 15 minutes
-const REFRESH_COOKIE_NAME = "aynwerd_rt";
-
-function refreshCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: env.cookieSecure,
-    sameSite: "lax",
-    path: "/api/auth",
-    maxAge: 7 * 24 * 60 * 60 * 1000,
-  };
-}
+const REFRESH_TOKEN_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+
+// --------------------------------------------------------------------
+// Refresh tokens are returned in the JSON response body (and stored by
+// the client in localStorage) rather than as an httpOnly cookie.
+//
+// Why: this API and its frontend are deployed on different domains
+// (e.g. a Hugging Face Space + a separate Vercel domain), and some
+// hosting proxies in that kind of cross-site setup intercept CORS
+// preflight requests before they reach the app and strip the
+// Access-Control-Allow-Credentials header — which silently breaks any
+// flow that depends on browsers sending a cross-site cookie. Avoiding
+// `credentials: include` entirely sidesteps that class of problem.
+//
+// The trade-off: an httpOnly cookie can never be read by JavaScript,
+// even from an XSS payload; a token sitting in localStorage can be.
+// We narrow that risk with what's still in our control — access
+// tokens stay short-lived (15 min) and refresh tokens rotate on every
+// use with reuse detection (see `refresh` below) — but this is
+// genuinely a lower security bar than the cookie-based approach, and
+// worth knowing if you migrate this API to a same-site deployment
+// later (at which point switching back to an httpOnly cookie is
+// recommended).
+// --------------------------------------------------------------------
 
 async function audit(action, req, extra = {}) {
   try {
@@ -33,6 +45,20 @@ async function audit(action, req, extra = {}) {
   }
 }
 
+function issueSession(user, req) {
+  const accessToken = signAccessToken(user);
+  const { token: refreshToken, jti } = signRefreshToken(user);
+  user.activeRefreshTokens = (user.activeRefreshTokens || [])
+    .filter((rt) => rt.expiresAt > new Date()) // prune expired sessions as we go
+    .concat({
+      jti,
+      expiresAt: new Date(Date.now() + REFRESH_TOKEN_LIFETIME_MS),
+      userAgent: req.headers["user-agent"],
+      ip: req.ip,
+    });
+  return { accessToken, refreshToken };
+}
+
 async function signup(req, res, next) {
   try {
     const { name, email, password } = req.body;
@@ -50,19 +76,10 @@ async function signup(req, res, next) {
 
     await audit("user.signup", req, { email: user.email });
 
-    const accessToken = signAccessToken(user);
-    const { token: refreshToken, jti } = signRefreshToken(user);
-    user.activeRefreshTokens = user.activeRefreshTokens || [];
-    user.activeRefreshTokens.push({
-      jti,
-      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-      userAgent: req.headers["user-agent"],
-      ip: req.ip,
-    });
+    const { accessToken, refreshToken } = issueSession(user, req);
     await user.save();
 
-    res.cookie(REFRESH_COOKIE_NAME, refreshToken, refreshCookieOptions());
-    res.status(201).json({ user: user.toSafeJSON(), accessToken });
+    res.status(201).json({ user: user.toSafeJSON(), accessToken, refreshToken });
   } catch (err) {
     next(err);
   }
@@ -102,22 +119,12 @@ async function login(req, res, next) {
     user.failedLoginAttempts = 0;
     user.lockUntil = null;
 
-    const accessToken = signAccessToken(user);
-    const { token: refreshToken, jti } = signRefreshToken(user);
-    user.activeRefreshTokens = (user.activeRefreshTokens || [])
-      .filter((rt) => rt.expiresAt > new Date()) // prune expired sessions
-      .concat({
-        jti,
-        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
+    const { accessToken, refreshToken } = issueSession(user, req);
     await user.save();
 
     await audit("user.login", req, { email: user.email });
 
-    res.cookie(REFRESH_COOKIE_NAME, refreshToken, refreshCookieOptions());
-    res.json({ user: user.toSafeJSON(), accessToken });
+    res.json({ user: user.toSafeJSON(), accessToken, refreshToken });
   } catch (err) {
     next(err);
   }
@@ -125,14 +132,13 @@ async function login(req, res, next) {
 
 async function refresh(req, res, next) {
   try {
-    const token = req.cookies[REFRESH_COOKIE_NAME];
+    const { refreshToken: token } = req.body;
     if (!token) return res.status(401).json({ error: "No refresh token provided." });
 
     let payload;
     try {
       payload = verifyRefreshToken(token);
     } catch {
-      res.clearCookie(REFRESH_COOKIE_NAME, refreshCookieOptions());
       return res.status(401).json({ error: "Invalid or expired session, please log in again." });
     }
 
@@ -143,25 +149,21 @@ async function refresh(req, res, next) {
 
     const stillActive = (user.activeRefreshTokens || []).some((rt) => rt.jti === payload.jti);
     if (!stillActive) {
-      // Possible token reuse after logout/rotation — deny and clear cookie.
-      res.clearCookie(REFRESH_COOKIE_NAME, refreshCookieOptions());
+      // Possible reuse of an already-rotated (or logged-out) refresh
+      // token — deny it. As a precaution, also revoke every other
+      // active session for this account, since a replayed token is a
+      // signal the original may have leaked.
+      user.activeRefreshTokens = [];
+      await user.save();
       return res.status(401).json({ error: "Session no longer valid, please log in again." });
     }
 
     // Rotate: remove old jti, issue a new refresh token.
     user.activeRefreshTokens = user.activeRefreshTokens.filter((rt) => rt.jti !== payload.jti);
-    const accessToken = signAccessToken(user);
-    const { token: newRefreshToken, jti: newJti } = signRefreshToken(user);
-    user.activeRefreshTokens.push({
-      jti: newJti,
-      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-      userAgent: req.headers["user-agent"],
-      ip: req.ip,
-    });
+    const { accessToken, refreshToken: newRefreshToken } = issueSession(user, req);
     await user.save();
 
-    res.cookie(REFRESH_COOKIE_NAME, newRefreshToken, refreshCookieOptions());
-    res.json({ accessToken, user: user.toSafeJSON() });
+    res.json({ accessToken, refreshToken: newRefreshToken, user: user.toSafeJSON() });
   } catch (err) {
     next(err);
   }
@@ -169,7 +171,7 @@ async function refresh(req, res, next) {
 
 async function logout(req, res, next) {
   try {
-    const token = req.cookies[REFRESH_COOKIE_NAME];
+    const { refreshToken: token } = req.body;
     if (token) {
       try {
         const payload = verifyRefreshToken(token);
@@ -178,7 +180,6 @@ async function logout(req, res, next) {
         // token already invalid — nothing to revoke
       }
     }
-    res.clearCookie(REFRESH_COOKIE_NAME, refreshCookieOptions());
     res.json({ success: true });
   } catch (err) {
     next(err);

src/routes/auth.routes.js

@@ -38,8 +38,13 @@ router.post(
   ctrl.login
 );
 
-router.post("/refresh", ctrl.refresh);
-router.post("/logout", ctrl.logout);
+router.post(
+  "/refresh",
+  [body("refreshToken").notEmpty().withMessage("A refresh token is required.")],
+  validate,
+  ctrl.refresh
+);
+router.post("/logout", [body("refreshToken").optional({ nullable: true }).isString()], validate, ctrl.logout);
 router.get("/me", requireAuth, ctrl.me);
 
 module.exports = router;