Skip to content

[Backend][Security][P2] Stop Returning JWTs in JSON Bodies Where Cookie Auth Suffices #233

Description

@AnshRaj112

Backlog ID: ISSUE-KMP-088 | Epic: EPIC-02 | Complexity: Medium

Description

ISSUE-KMP-088 is a Medium severity / P2 priority Security issue in @kampyn-backend, under Authentication.

Problem overview

This work item asks the team to: Stop Returning JWTs in JSON Bodies Where Cookie Auth Suffices.

Today the system behaves as follows: userAuthController and refresh handlers return token.

That is incorrect or insufficient for a production multi-tenant platform. After this issue is fixed, the expected outcome is: Cookie-only for browsers; tokens in body only for documented non-browser clients if required.

Why this issue exists

Encourages insecure client storage.

If this remains unresolved, realistic consequences include: Clients store tokens insecurely.

This finding is grounded in the technical audit: Audit Authentication Token in JSON body.

Implementation scope

Concrete touchpoints are listed later in this issue (1 file path(s) and 2 API/function touchpoint(s)). Use those lists during implementation and code review so nothing in scope is missed.

Recommended direction (outcome-focused, not a mandatory design): Omit token from body for web clients after KMP-018.

Planning

  • Estimated complexity: Medium
  • Priority rationale: Supports cookie migration.
  • Depends on:
    • ISSUE-KMP-018

Do not treat this issue as independently shippable until listed dependencies are addressed or explicitly waived.

Definition of done

Close this issue only when every Acceptance Criteria checkbox is complete and the Testing Requirements have been run (or waived with written rationale on the PR). The title states the change; this description, the expected behavior, and the acceptance criteria together define success.

Current Behavior

userAuthController and refresh handlers return token.

Expected Behavior

Cookie-only for browsers; tokens in body only for documented non-browser clients if required.

Why This Matters

Encourages insecure client storage.

Evidence From Audit

Audit Authentication Token in JSON body.

Risk / Impact

Clients store tokens insecurely.

Recommended Direction

Omit token from body for web clients after KMP-018.

Acceptance Criteria

  • Web login success does not require reading token from JSON
  • Documented exception for mobile if any

Testing Requirements

  • Integration test

Dependencies

  • ISSUE-KMP-018

Affected Files

  • kampyn-backend/controllers/auth/

Affected Functions / APIs

  • login
  • refresh

Created from KAMPYN_GITHUB_ISSUES.md

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions