# Step 1: Login and save session
curl -c cookies.txt -X POST https://target.com/api/login \
     -H 'Content-Type: application/json' \
     -d '{"email":"test@test.com","password":"test123"}'

# Step 2: Confirm baseline works
curl -b cookies.txt https://target.com/api/me
# → {"user_id":1001,"email":"test@test.com"}

# Step 3: Wait 30 minutes (genuinely idle)
sleep 1800

# Step 4: Replay old session
curl -b cookies.txt https://target.com/api/me
# SECURE:     HTTP 401 Unauthorized
# VULNERABLE: HTTP 200 + user data → idle timeout MISSING

# Keep session alive with periodic pings, test for absolute expiry
START=$(date +%s)
while true; do
  CODE=$(curl -b cookies.txt -s -o /dev/null -w '%{http_code}' \
         https://target.com/api/me)
  ELAPSED=$(( ($(date +%s) - $START) / 60 ))
  echo "t+${ELAPSED}min: HTTP $CODE"
  [ "$CODE" = '401' ] && echo "Session expired at t+${ELAPSED}min" && break
  sleep 300  # ping every 5 min to keep alive
done

# Expected results:
# t+480min (8h): 401 → Good absolute timeout
# t+1440min (24h): 200 OK → Missing absolute timeout!

# Session 1: Login from Device A
curl -c session1.txt -X POST https://target.com/api/login \
     -d '{"email":"test@test.com","password":"test123"}'

# Session 2: Login from Device B (different session)
curl -c session2.txt -X POST https://target.com/api/login \
     -d '{"email":"test@test.com","password":"test123"}'

# Change password using Session 1
curl -b session1.txt -X POST https://target.com/api/password/change \
     -d '{"old":"test123","new":"NewPass456!"}'

# Test Session 2 (other device) after password change
curl -b session2.txt https://target.com/api/me
# SECURE:     401 → All other sessions invalidated on password change
# VULNERABLE: 200 → Session 2 still valid despite password change!

# Decode JWT payload (middle section between dots)
echo 'eyJ1c2VyX2lkIjoxMDAxfQ==' | base64 -d
# Or: python3 jwt_tool.py YOUR_TOKEN

# SECURE — short expiry:
{"user_id": 1001, "exp": 1704067815}  ← 15 min from now

# VULNERABLE — far-future expiry:
{"user_id": 1001, "exp": 4102444800}  ← Year 2099!

# CRITICAL — no exp at all:
{"user_id": 1001}  ← No exp → permanent token

# Convert exp timestamp to human date:
python3 -c "import datetime; print(datetime.datetime.fromtimestamp(4102444800))"
# → 2099-12-31 00:00:00

# Even if exp is set, the server must validate it!
# Some servers issue tokens with correct exp but never check it.

# Step 1: Get a JWT with short exp (e.g. 15-minute token)
# Step 2: Wait for it to expire (wait 20 minutes)
# Step 3: Replay the expired JWT
curl -H "Authorization: Bearer EXPIRED_JWT_TOKEN" \
     https://target.com/api/me

# SECURE:     HTTP 401 {"error": "Token expired"}
# VULNERABLE: HTTP 200 + user data → exp claim NOT validated!

// Node.js / Express — Both timeout types
app.use(session({
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
        httpOnly: true,
        secure:   true,
        sameSite: 'strict',
        maxAge:   15 * 60 * 1000  // 15 min idle timeout
    },
    rolling: true,  // reset idle timer on every request
}));

// Absolute timeout middleware
app.use((req, res, next) => {
    if (req.session?.loginTime) {
        const elapsed = Date.now() - req.session.loginTime;
        if (elapsed > 8 * 60 * 60 * 1000) {  // 8 hour absolute
            req.session.destroy();
            return res.status(401).json({error: 'Session expired'});
        }
    }
    next();
});

// JWT — always set short exp
const token = jwt.sign(
    {user_id: user.id, role: user.role},
    process.env.JWT_SECRET,
    {expiresIn: '15m'}  // never omit expiresIn!
);