Session Expiration

// Node.js/Express - Secure session expiration

const session = require('express-session');
const RedisStore = require('connect-redis').default;
const redis = require('redis');
const bcrypt = require('bcrypt');

// SECURE: Configure Redis client for session storage with TTL
const redisClient = redis.createClient({
  host: process.env.REDIS_HOST,
  port: process.env.REDIS_PORT
});

app.use(session({
  store: new RedisStore({
    client: redisClient,
    // SECURE: Server-side TTL for sessions
    ttl: 1800  // 30 minutes in seconds
  }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  rolling: true,  // SECURE: Sliding expiration - resets on each request
  cookie: {
    maxAge: 1800000,  // SECURE: 30 minute idle timeout (ms)
    httpOnly: true,   // SECURE: Prevent XSS access
    secure: true,     // SECURE: HTTPS only
    sameSite: 'strict'  // SECURE: CSRF protection
  }
}));

// SECURE: Track session creation time for absolute timeout
app.use((req, res, next) => {
  if (req.session && !req.session.createdAt) {
    req.session.createdAt = Date.now();
  }
  
  // SECURE: Enforce absolute session lifetime (12 hours)
  const ABSOLUTE_TIMEOUT = 12 * 60 * 60 * 1000;  // 12 hours in ms
  if (req.session && req.session.createdAt) {
    const sessionAge = Date.now() - req.session.createdAt;
    if (sessionAge > ABSOLUTE_TIMEOUT) {
      // SECURE: Destroy session after absolute timeout
      req.session.destroy();
      return res.status(401).json({ 
        error: 'Session expired',
        reason: 'Maximum session lifetime exceeded' 
      });
    }
  }
  
  // SECURE: Update last activity timestamp
  if (req.session && req.session.userId) {
    req.session.lastActivity = Date.now();
  }
  
  next();
});

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await User.findOne({ email });
  
  if (user && await bcrypt.compare(password, user.passwordHash)) {
    // SECURE: Regenerate session ID on login to prevent fixation
    req.session.regenerate((err) => {
      if (err) {
        return res.status(500).json({ error: 'Session error' });
      }
      
      req.session.userId = user._id;
      req.session.createdAt = Date.now();
      req.session.lastActivity = Date.now();
      
      res.json({ message: 'Login successful' });
    });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

// SECURE: Remember-me with rotating tokens
app.post('/remember-me', authenticateSession, async (req, res) => {
  const user = req.user;
  
  // SECURE: Generate cryptographically strong token
  const rememberToken = crypto.randomBytes(32).toString('hex');
  const tokenHash = await bcrypt.hash(rememberToken, 10);
  
  // SECURE: Store token hash with expiration
  await User.findByIdAndUpdate(user._id, {
    rememberToken: tokenHash,
    rememberTokenExpiry: Date.now() + (30 * 24 * 60 * 60 * 1000)  // 30 days
  });
  
  // SECURE: Set cookie with explicit maxAge
  res.cookie('remember_me', rememberToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 30 * 24 * 60 * 60 * 1000  // 30 days
  });
  
  res.json({ message: 'Remember me enabled' });
});

// Middleware to restore session from remember-me token
app.use(async (req, res, next) => {
  if (!req.session.userId && req.cookies.remember_me) {
    const token = req.cookies.remember_me;
    
    // Find user with valid remember token
    const users = await User.find({
      rememberTokenExpiry: { $gt: Date.now() }
    });
    
    for (const user of users) {
      if (await bcrypt.compare(token, user.rememberToken)) {
        // SECURE: Rotate the remember token on use
        const newToken = crypto.randomBytes(32).toString('hex');
        const newTokenHash = await bcrypt.hash(newToken, 10);
        
        await User.findByIdAndUpdate(user._id, {
          rememberToken: newTokenHash,
          rememberTokenExpiry: Date.now() + (30 * 24 * 60 * 60 * 1000)
        });
        
        // SECURE: Issue new cookie with rotated token
        res.cookie('remember_me', newToken, {
          httpOnly: true,
          secure: true,
          sameSite: 'strict',
          maxAge: 30 * 24 * 60 * 60 * 1000
        });
        
        // Create new session
        req.session.userId = user._id;
        req.session.createdAt = Date.now();
        break;
      }
    }
  }
  next();
});

// SECURE: Password change invalidates all sessions
app.post('/change-password', authenticateSession, async (req, res) => {
  const { currentPassword, newPassword } = req.body;
  const user = await User.findById(req.session.userId);
  
  const valid = await bcrypt.compare(currentPassword, user.passwordHash);
  if (!valid) {
    return res.status(401).json({ error: 'Current password incorrect' });
  }
  
  const newHash = await bcrypt.hash(newPassword, 12);
  
  // SECURE: Increment session version to invalidate old sessions
  await User.findByIdAndUpdate(user._id, {
    passwordHash: newHash,
    sessionVersion: (user.sessionVersion || 0) + 1,
    rememberToken: null,  // SECURE: Invalidate remember-me
    rememberTokenExpiry: null
  });
  
  // SECURE: Destroy current session (user will need to re-login)
  req.session.destroy();
  
  res.json({ message: 'Password changed. Please login again.' });
});

// SECURE: Logout with explicit session destruction
app.post('/logout', authenticateSession, (req, res) => {
  const userId = req.session.userId;
  
  // SECURE: Destroy server-side session
  req.session.destroy((err) => {
    if (err) {
      return res.status(500).json({ error: 'Logout failed' });
    }
    
    // SECURE: Clear remember-me cookie
    res.clearCookie('remember_me');
    res.clearCookie('connect.sid');  // Session cookie
    
    res.json({ message: 'Logged out successfully' });
  });
});

// SECURE: Require recent authentication for sensitive operations
const requireRecentAuth = (req, res, next) => {
  const RECENT_AUTH_WINDOW = 5 * 60 * 1000;  // 5 minutes
  
  if (!req.session.lastAuthTime) {
    return res.status(403).json({ 
      error: 'Recent authentication required',
      needsReauth: true 
    });
  }
  
  const timeSinceAuth = Date.now() - req.session.lastAuthTime;
  if (timeSinceAuth > RECENT_AUTH_WINDOW) {
    return res.status(403).json({ 
      error: 'Recent authentication required',
      needsReauth: true 
    });
  }
  
  next();
};

// SECURE: Step-up authentication endpoint
app.post('/reauth', authenticateSession, async (req, res) => {
  const { password } = req.body;
  const user = await User.findById(req.session.userId);
  
  if (await bcrypt.compare(password, user.passwordHash)) {
    req.session.lastAuthTime = Date.now();
    res.json({ message: 'Re-authenticated successfully' });
  } else {
    res.status(401).json({ error: 'Invalid password' });
  }
});

// SECURE: Sensitive operations require recent auth
app.post('/billing/update', authenticateSession, requireRecentAuth, async (req, res) => {
  // Update payment method - only allowed with recent authentication
  const { cardNumber, exp, cvv } = req.body;
  
  await User.findByIdAndUpdate(req.session.userId, {
    paymentMethod: { cardNumber, exp }
  });
  
  res.json({ message: 'Payment method updated' });
});

app.post('/security/mfa-disable', authenticateSession, requireRecentAuth, async (req, res) => {
  // Disable MFA - requires recent authentication
  await User.findByIdAndUpdate(req.session.userId, {
    mfaEnabled: false,
    mfaSecret: null
  });
  
  res.json({ message: 'MFA disabled' });
});