Repository navigation
JWT denylist revocation check fails open on Redis outage #68
Description
Why this matters now: A compromised token cannot be reliably revoked during an infra incident — the exact moment revocation matters most.
Problem / What: In auth.ts:26-40, if the Redis GET jwt_denylist:... throws and the middleware is not strict, it // fail open and proceeds. So during a Redis outage, all revoked tokens (including those explicitly logged out) are accepted. The strict variant exists but is not the default path used by most routes.
Key Challenges: Choosing fail-closed vs availability consciously; if fail-closed, ensuring a Redis blip doesn't log everyone out (e.g., short negative cache / circuit breaker with a safe default).
Acceptance Criteria:
- Behavior under Redis failure is explicit and documented; a test proves revoked tokens are rejected (or the failure mode is deliberately and safely chosen).
- No silent acceptance of a known-revoked
jti.
Relevant files/functions: src/middleware/auth.ts:26-40, src/controllers/authController.ts:99-103, src/services/rateLimitService.ts.
Out of scope: Switching to short-lived access + refresh tokens (separate initiative).
Labels: advanced, security, auth
Activity
malaysiaonelove commentedon Aug 21, 2026
Hi maintain,I will love to work on this issue,I have an experience and I have already reviewed the issue please assigned me to it and I will give a good result.
grantfox-oss commentedon Aug 21, 2026
🦊 GrantFox — @malaysiaonelove has been assigned to this issue as part of the Third Campaign campaign!
Next steps:
Closes #68)Good luck! Track your progress on GrantFox.
fix(auth): fail-closed JWT denylist check with circuit breaker on Red…
grantfox-oss commentedon Aug 29, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!
@malaysiaonelove's PR #100 was approved and merged by @cybermax4200.
🏆 @malaysiaonelove: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (802 total points). Track your full progress on GrantFox.
👏 Great work, @malaysiaonelove! Keep contributing to ecotask-network.
fix(auth): fail-closed JWT denylist check with circuit breaker on Red…