fix(auth): reject expired JWT on session read #2

Open

jules wants to merge 1 commits from fix/audit-jwt-expiry-main into main

Author	SHA1	Message	Date
jules	ea34bcd886	fix(auth): reject expired JWT on session read (silent-401 shell) readFromStorage validated token shape but never checked exp, so an expired token mounted the full authed shell and every API call 401d silently. Decode the JWT and treat an expired token as no session. Pattern backported from skyai-finance. Frontend audit 2026-06-20, rank 1. Also clears the localStorage Session in onUnauthorized (root.tsx) so a 401 fully logs out instead of leaving a dead session behind getToken. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-20 20:24:20 +10:00

Author

SHA1

Message

Date

jules

ea34bcd886

fix(auth): reject expired JWT on session read (silent-401 shell)

readFromStorage validated token shape but never checked exp, so an expired
token mounted the full authed shell and every API call 401d silently. Decode
the JWT and treat an expired token as no session. Pattern backported from
skyai-finance. Frontend audit 2026-06-20, rank 1.

Also clears the localStorage Session in onUnauthorized (root.tsx) so a 401
fully logs out instead of leaving a dead session behind getToken.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-20 20:24:20 +10:00

fix(auth): reject expired JWT on session read #2

1 Commits