fix(core): revoke active JWT tokens after logout

[Sourav-kashyap]

GH-2570

JWT Logout Security Fix

Problem Statement

Security Vulnerability: JWT Tokens Remain Valid After Logout

Issue: When a user logs out of the system, their JWT access token remains valid until its natural expiration time, allowing the token to be used for authenticated requests even after logout.

Impact: This creates a security vulnerability where:

1. Logged-out users retain access to protected APIs until their JWT naturally expires
2. Session invalidation through logout is ineffective
3. In case of security incidents, compromised tokens cannot be immediately revoked
4. Access token lifetime becomes the effective session lifetime, regardless of logout

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• Performed a self-review of my own code
• npm test passes on your machine

Build:

Test:

[samarpan-b]

where are we revoking this token actually ?

[Sourav-kashyap]

sir the token is revoked using the existing RevokedTokenRepository

on logout (idp-login.service.ts) : token is stored via revokedTokensRepo.set()

on api request (services-bearer-asym-token-verifier.ts) : token is checked via checkIfTokenRevoked() which calls revokedTokenRepo.get(token) and throws TokenRevoked error if found

The same mechanism that the authentication service and facade services already use - we just added the same check to the service-level verifiers which were missing it.

[sonarqubecloud]

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud