Edouard Vanbelle
b90fa6f619
Security: session hardening Refresh token rotation with theft detection (family_id) - Added family_id column to auth.sessions (migration 20260507000000_session_family.sql) grouping all tokens issued from the same login into a family - On refresh, the new session inherits the parent's family_id - If a revoked token is replayed (indicates the token was stolen after rotation), the entire family is immediately invalidated and a warning is logged — forcing re-authentication on all devices SameSite=Strict on refresh cookie - Access cookie stays SameSite=Lax (needed for top-level navigation) - Refresh cookie upgraded to SameSite=Strict — it is only ever used for explicit POST to /api/auth/refresh, never via cross-site navigation Refresh token TTL: 30 days → 7 days - With rotation, active sessions auto-renew and effectively never expire - Inactive sessions expire after 7 days instead of 30, reducing the theft window
116 lines
2.5 KiB
Rust
116 lines
2.5 KiB
Rust
use chrono::{DateTime, Duration, Utc};
|
|
use uuid::Uuid;
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct Session {
|
|
id: Uuid,
|
|
user_id: Uuid,
|
|
refresh_token: String,
|
|
expires_at: DateTime<Utc>,
|
|
ip_address: Option<String>,
|
|
user_agent: Option<String>,
|
|
created_at: DateTime<Utc>,
|
|
revoked: bool,
|
|
/// Groups all tokens issued from the same original login.
|
|
/// Replaying a revoked token from this family triggers full-family revocation.
|
|
family_id: Uuid,
|
|
}
|
|
|
|
impl Session {
|
|
pub fn new(
|
|
user_id: Uuid,
|
|
refresh_token: String,
|
|
ip_address: Option<String>,
|
|
user_agent: Option<String>,
|
|
expires_in_days: i64,
|
|
family_id: Uuid,
|
|
) -> Self {
|
|
if refresh_token.is_empty() {
|
|
panic!("Session refresh_token cannot be empty");
|
|
}
|
|
|
|
let now = Utc::now();
|
|
Self {
|
|
id: Uuid::new_v4(),
|
|
user_id,
|
|
refresh_token,
|
|
expires_at: now + Duration::days(expires_in_days),
|
|
ip_address,
|
|
user_agent,
|
|
created_at: now,
|
|
revoked: false,
|
|
family_id,
|
|
}
|
|
}
|
|
|
|
#[allow(clippy::too_many_arguments)]
|
|
pub fn from_raw(
|
|
id: Uuid,
|
|
user_id: Uuid,
|
|
refresh_token: String,
|
|
expires_at: DateTime<Utc>,
|
|
ip_address: Option<String>,
|
|
user_agent: Option<String>,
|
|
created_at: DateTime<Utc>,
|
|
revoked: bool,
|
|
family_id: Uuid,
|
|
) -> Self {
|
|
Self {
|
|
id,
|
|
user_id,
|
|
refresh_token,
|
|
expires_at,
|
|
ip_address,
|
|
user_agent,
|
|
created_at,
|
|
revoked,
|
|
family_id,
|
|
}
|
|
}
|
|
|
|
// Getters
|
|
pub fn id(&self) -> Uuid {
|
|
self.id
|
|
}
|
|
|
|
pub fn user_id(&self) -> Uuid {
|
|
self.user_id
|
|
}
|
|
|
|
pub fn refresh_token(&self) -> &str {
|
|
&self.refresh_token
|
|
}
|
|
|
|
pub fn expires_at(&self) -> DateTime<Utc> {
|
|
self.expires_at
|
|
}
|
|
|
|
pub fn ip_address(&self) -> Option<&str> {
|
|
self.ip_address.as_deref()
|
|
}
|
|
|
|
pub fn user_agent(&self) -> Option<&str> {
|
|
self.user_agent.as_deref()
|
|
}
|
|
|
|
pub fn created_at(&self) -> DateTime<Utc> {
|
|
self.created_at
|
|
}
|
|
|
|
pub fn is_expired(&self) -> bool {
|
|
Utc::now() > self.expires_at
|
|
}
|
|
|
|
pub fn is_revoked(&self) -> bool {
|
|
self.revoked
|
|
}
|
|
|
|
pub fn revoke(&mut self) {
|
|
self.revoked = true;
|
|
}
|
|
|
|
pub fn family_id(&self) -> Uuid {
|
|
self.family_id
|
|
}
|
|
}
|