Merge pull request #2423 from nocodb/fix/jwt-expiresIn

fix: expired jwt token still usable

packages/nocodb/src/lib/Noco.ts

@@ -187,7 +187,7 @@ export default class Noco {
     }
 
     await Noco._ncMeta.metaInit();
-    await this.readOrGenJwtSecret();
+    await this.initJwt();
     await initAdminFromEnv();
 
     await NcUpgrader.upgrade({ ncMeta: Noco._ncMeta });
@@ -489,8 +489,9 @@ export default class Noco {
     }
   }
 
-  private async readOrGenJwtSecret(): Promise<any> {
+  private async initJwt(): Promise<any> {
-    if (this.config?.auth?.jwt && !this.config.auth.jwt.secret) {
+    if (this.config?.auth?.jwt) {
+      if (!this.config.auth.jwt.secret) {
         let secret = (
           await Noco._ncMeta.metaGet('', '', 'nc_store', {
             key: 'nc_auth_jwt_secret'
@@ -504,6 +505,13 @@ export default class Noco {
         }
         this.config.auth.jwt.secret = secret;
       }
+
+      this.config.auth.jwt.options = this.config.auth.jwt.options || {};
+      if (!this.config.auth.jwt.options?.expiresIn) {
+        this.config.auth.jwt.options.expiresIn =
+          process.env.NC_JWT_EXPIRES_IN ?? '10h';
+      }
+    }
     let serverId = (
       await Noco._ncMeta.metaGet('', '', 'nc_store', {
         key: 'nc_server_id'

packages/nocodb/src/lib/meta/api/userApi/initStrategies.ts

@@ -2,18 +2,17 @@ import User from '../../../models/User';
 import ProjectUser from '../../../models/ProjectUser';
 import { promisify } from 'util';
 import { Strategy as CustomStrategy } from 'passport-custom';
-
-import { Strategy } from 'passport-jwt';
 import passport from 'passport';
-import { ExtractJwt } from 'passport-jwt';
+import passportJWT from 'passport-jwt';
 import { Strategy as AuthTokenStrategy } from 'passport-auth-token';
 import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
 import { randomTokenString } from '../../helpers/stringHelpers';
 
 const PassportLocalStrategy = require('passport-local').Strategy;
+const ExtractJwt = passportJWT.ExtractJwt;
+const JwtStrategy = passportJWT.Strategy;
 
 const jwtOptions = {
-  expiresIn: process.env.NC_JWT_EXPIRES_IN ?? '10h',
   jwtFromRequest: ExtractJwt.fromHeader('xc-auth')
 };
 
@@ -84,7 +83,7 @@ export function initStrategies(router): void {
   });
 
   passport.use(
-    new Strategy(
+    new JwtStrategy(
       {
         secretOrKey: Noco.getConfig().auth.jwt.secret,
         ...jwtOptions,