Backlog ID: ISSUE-KMP-088 | Epic: EPIC-02 | Complexity: Medium
Description
ISSUE-KMP-088 is a Medium severity / P2 priority Security issue in @kampyn-backend, under Authentication.
Problem overview
This work item asks the team to: Stop Returning JWTs in JSON Bodies Where Cookie Auth Suffices.
Today the system behaves as follows: userAuthController and refresh handlers return token.
That is incorrect or insufficient for a production multi-tenant platform. After this issue is fixed, the expected outcome is: Cookie-only for browsers; tokens in body only for documented non-browser clients if required.
Why this issue exists
Encourages insecure client storage.
If this remains unresolved, realistic consequences include: Clients store tokens insecurely.
This finding is grounded in the technical audit: Audit Authentication Token in JSON body.
Implementation scope
Concrete touchpoints are listed later in this issue (1 file path(s) and 2 API/function touchpoint(s)). Use those lists during implementation and code review so nothing in scope is missed.
Recommended direction (outcome-focused, not a mandatory design): Omit token from body for web clients after KMP-018.
Planning
- Estimated complexity: Medium
- Priority rationale: Supports cookie migration.
- Depends on:
Do not treat this issue as independently shippable until listed dependencies are addressed or explicitly waived.
Definition of done
Close this issue only when every Acceptance Criteria checkbox is complete and the Testing Requirements have been run (or waived with written rationale on the PR). The title states the change; this description, the expected behavior, and the acceptance criteria together define success.
Current Behavior
userAuthController and refresh handlers return token.
Expected Behavior
Cookie-only for browsers; tokens in body only for documented non-browser clients if required.
Why This Matters
Encourages insecure client storage.
Evidence From Audit
Audit Authentication Token in JSON body.
Risk / Impact
Clients store tokens insecurely.
Recommended Direction
Omit token from body for web clients after KMP-018.
Acceptance Criteria
Testing Requirements
Dependencies
Affected Files
kampyn-backend/controllers/auth/
Affected Functions / APIs
Created from KAMPYN_GITHUB_ISSUES.md
Description
ISSUE-KMP-088 is a Medium severity / P2 priority Security issue in @kampyn-backend, under Authentication.
Problem overview
This work item asks the team to: Stop Returning JWTs in JSON Bodies Where Cookie Auth Suffices.
Today the system behaves as follows: userAuthController and refresh handlers return token.
That is incorrect or insufficient for a production multi-tenant platform. After this issue is fixed, the expected outcome is: Cookie-only for browsers; tokens in body only for documented non-browser clients if required.
Why this issue exists
Encourages insecure client storage.
If this remains unresolved, realistic consequences include: Clients store tokens insecurely.
This finding is grounded in the technical audit: Audit Authentication Token in JSON body.
Implementation scope
Concrete touchpoints are listed later in this issue (1 file path(s) and 2 API/function touchpoint(s)). Use those lists during implementation and code review so nothing in scope is missed.
Recommended direction (outcome-focused, not a mandatory design): Omit token from body for web clients after KMP-018.
Planning
Do not treat this issue as independently shippable until listed dependencies are addressed or explicitly waived.
Definition of done
Close this issue only when every Acceptance Criteria checkbox is complete and the Testing Requirements have been run (or waived with written rationale on the PR). The title states the change; this description, the expected behavior, and the acceptance criteria together define success.
Current Behavior
userAuthController and refresh handlers return token.
Expected Behavior
Cookie-only for browsers; tokens in body only for documented non-browser clients if required.
Why This Matters
Encourages insecure client storage.
Evidence From Audit
Audit Authentication Token in JSON body.
Risk / Impact
Clients store tokens insecurely.
Recommended Direction
Omit token from body for web clients after KMP-018.
Acceptance Criteria
Testing Requirements
Dependencies
Affected Files
kampyn-backend/controllers/auth/Affected Functions / APIs
loginrefreshCreated from KAMPYN_GITHUB_ISSUES.md