fix(backend:auth): update token expiration and enforce no-store Cache-Control headers

Author: johaven

backend/src/applications/links/links.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, Param, Post, Req, Res, StreamableFile, UseGuards } from '@nestjs/common'
+import { Body, Controller, Get, Header, Param, Post, Req, Res, StreamableFile, UseGuards } from '@nestjs/common'
 import { Throttle } from '@nestjs/throttler'
 import { FastifyReply, FastifyRequest } from 'fastify'
 import { AuthTokenOptional } from '../../authentication/decorators/auth-token-optional.decorator'
@@ -31,6 +31,7 @@ export class LinksController {
   }
 
   @Get(`${PUBLIC_LINKS_ROUTE.ACCESS}/:uuid`)
+  @Header('Cache-Control', 'no-store')
   @UseGuards(AuthRateLimitGuard)
   linkAccess(
     @GetUser() user: UserModel,
@@ -54,6 +55,7 @@ export class LinksController {
   }
 
   @Post(`${PUBLIC_LINKS_ROUTE.AUTH}/:uuid`)
+  @Header('Cache-Control', 'no-store')
   @UseGuards(AuthRateLimitGuard)
   linkAuthentication(
     @GetUser() user: UserModel,

backend/src/applications/sync/sync.controller.ts

@@ -4,6 +4,7 @@ import {
   Copy,
   Delete,
   Get,
+  Header,
   HttpException,
   HttpStatus,
   Move,
@@ -70,13 +71,15 @@ export class SyncController {
   }
 
   @Post(SYNC_ROUTE.REGISTER)
+  @Header('Cache-Control', 'no-store')
   @AuthTokenSkip()
   @UseGuards(AuthRateLimitGuard)
   register(@Body() syncClientRegistrationDto: SyncClientRegistrationDto, @Req() req: FastifyRequest): Promise<SyncClientAuthRegistration> {
     return this.syncClientsManager.register(syncClientRegistrationDto, req.ip)
   }
 
   @Post(SYNC_ROUTE.REGISTER_AUTH)
+  @Header('Cache-Control', 'no-store')
   @UserHavePermission(USER_PERMISSION.DESKTOP_APP)
   @UseGuards(UserPermissionsGuard)
   registerWithAuth(
@@ -101,6 +104,7 @@ export class SyncController {
   }
 
   @Post(`${SYNC_ROUTE.AUTH}/:type`)
+  @Header('Cache-Control', 'no-store')
   @AuthTokenSkip()
   @UseGuards(AuthRateLimitGuard)
   authenticate(

backend/src/applications/users/users.md

@@ -35,7 +35,8 @@ the password-attempt limit does not suspend the account.
 `isActive` is the durable administrative switch for a local user record:
 
 - `isActive: false` is rejected by local password and app-password paths as well as by the LDAP and OIDC provider flows;
-- authenticated requests and token refreshes reload the local user record, so disabling the account also invalidates existing sessions;
+- new authentication and token refreshes reload the local user record and reject an inactive account. Already-issued access tokens and positive
+  WebDAV authentication cache entries remain usable until they expire;
 - the account remains disabled until an administrator reactivates it; there is no automatic expiration;
 - reactivating the account resets `passwordAttempts` to zero.
 

backend/src/authentication/auth.config.ts

@@ -17,7 +17,7 @@ export class AuthTokenAccessConfig {
 
   @IsString()
   @IsNotEmpty()
-  expiration = '30m'
+  expiration = '15m'
 }
 
 export class AuthTokenRefreshConfig {

backend/src/authentication/auth.controller.ts

@@ -51,13 +51,15 @@ export class AuthController {
   }
 
   @Post(AUTH_ROUTE.TOKEN)
+  @Header('Cache-Control', 'no-store')
   @AuthTokenSkip()
   @UseGuards(AuthRateLimitGuard, AuthLocalGuard, AuthTwoFaVerificationWithoutPasswordGuard)
   token(@GetUser() user: UserModel): Promise<TokenResponseDto> {
     return this.authManager.getTokens(user)
   }
 
   @Post(AUTH_ROUTE.TOKEN_REFRESH)
+  @Header('Cache-Control', 'no-store')
   @AuthTokenSkip()
   @UseGuards(AuthTokenRefreshGuard)
   refreshToken(@GetUser() user: UserModel): Promise<TokenResponseDto> {
@@ -81,6 +83,7 @@ export class AuthController {
   }
 
   @Post(`${AUTH_ROUTE.TWO_FA_BASE}/${AUTH_ROUTE.TWO_FA_ENABLE}`)
+  @Header('Cache-Control', 'no-store')
   @UseGuards(AuthRateLimitGuard, UserRolesGuard)
   @UserHaveRole(USER_ROLE.USER)
   twoFaEnable(@Body() body: TwoFaVerifyWithPasswordDto, @Req() req: FastifyAuthenticatedRequest): Promise<TwoFaVerifyResult> {

environment/environment.dist.yaml

@@ -100,8 +100,8 @@ auth:
       # required
       secret:
       # token expiration = cookie maxAge
-      # default: `30m`
-      expiration: 30m
+      # default: `15m`
+      expiration: 15m
     refresh:
       # Used for token and cookie signatures
       # required