refactor: reject JWT expiration value at startup if less than 1 sec by ShradhaGupta31 · Pull Request #1172 · device-management-toolkit/console

ShradhaGupta31 · 2026-08-03T06:42:25Z

Changes Done:

Modified config.go to validate jwtExpiration while console startup
Reject non-positive values of jwtExpiration

Description:
config.yml accepts jwtExpiration: 0s which is a syntactically valid zero duration that the YAML parser accepts without error. At runtime, every issued JWT has exp = time.Now(), so all tokens expire at the moment of issuance and every subsequent API call is rejected.

Before fix : Server starts silently with jwtExpiration 0s, login returns an already-expired token:

$ curl -s -X POST http://localhost:8181/api/v1/authorize -H 'Content-Type: application/json' -d '{"username":<USER_NAME>,"password":<PASSWORD>}'
{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."} 

$ curl -s http://localhost:8181/api/v1/devices -H "Authorization: Bearer <token>"
{"error":"invalid access token"} # immediately rejected

After fix : Server would fail to start if jwtExpiration is set to 0s

$ GIN_MODE=debug go run ./cmd/app --config config.yml
Config error: config: auth.jwtExpiration must be positive (e.g. 24h) — zero causes tokens to expire on issuance
exit status 1

codecov · 2026-08-03T06:44:19Z

Codecov Report

❌ Patch coverage is 58.33333% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.30%. Comparing base (365531d) to head (c24ab98).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
config/config.go	58.33%	4 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1172      +/-   ##
==========================================
+ Coverage   50.24%   50.30%   +0.05%     
==========================================
  Files         147      147              
  Lines       13656    13668      +12     
==========================================
+ Hits         6862     6876      +14     
+ Misses       6199     6194       -5     
- Partials      595      598       +3

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR prevents a misconfigured auth.jwtExpiration / auth.redirectionJWTExpiration (zero or negative durations) from allowing the server to start and then immediately issuing already-expired JWTs, which effectively denies access to legitimate users.

Changes:

Adds startup-time config validation for JWT expiration durations.
Introduces sentinel errors for invalid JWT expiration settings.
Adds unit tests covering zero/negative durations and valid defaults.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`config/config.go`	Adds `Config.validate()` and calls it from `NewConfig()` to fail fast on non-positive JWT expirations.
`config/config_test.go`	Adds tests ensuring validation rejects zero/negative expirations and accepts defaults.

Suppressed comments (3)

config/config_test.go:133

The test asserts via substring matching on the error string. Since validate() returns a sentinel error, use require.ErrorIs so the test remains stable if the message wording changes.

	err := cfg.validate()
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.jwtExpiration")
}

config/config_test.go:144

The test asserts via substring matching on the error string. Since validate() returns a sentinel error, use require.ErrorIs so the test remains stable if the message wording changes.

	err := cfg.validate()
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.redirectionJWTExpiration")
}

config/config_test.go:155

The test asserts via substring matching on the error string. Since validate() returns a sentinel error, use require.ErrorIs so the test remains stable if the message wording changes.

	err := cfg.validate()
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.redirectionJWTExpiration")
}

sudhir-intc

LGTM, check if wee need to keep a minimum value of atleast 1m

madhavilosetty-intel · 2026-08-14T16:32:42Z

@ShradhaGupta31 The current validation rejects anything under 1 minute, but the commit says it’s rejecting zero/negative expirations. Please change it to <= 0.

ConsoleConfig is set to nil config.go line:353 only on validation failure, while earlier config errors leave it populated. Please keep the behavior consistent across all error paths.

ShradhaGupta31 · 2026-08-17T15:10:15Z

@ShradhaGupta31 The current validation rejects anything under 1 minute, but the commit says it’s rejecting zero/negative expirations. Please change it to <= 0.

ConsoleConfig is set to nil config.go line:353 only on validation failure, while earlier config errors leave it populated. Please keep the behavior consistent across all error paths.

@madhavilosetty-intel - Updated title & config.go as well.

- Modified config.go to validate jwtExpiration while console startup - Reject non-positive values of jwtExpiration Signed-off-by: ShradhaGupta31 <shradha.gupta@intel.com>

sudhir-intc

LGTM.
Please ensure the CI passes before the merge

RosieAMT · 2026-08-21T01:50:14Z