From 2dc267f52afb9bf56a7af9c358c44ddecee7035e Mon Sep 17 00:00:00 2001 From: tuanaiseo Date: Tue, 7 Apr 2026 18:42:26 +0700 Subject: [PATCH] fix(security): excessively long jwt access token lifetime `ACCESS_TOKEN_EXPIRE_MINUTES` is set to `60 * 60` (3600 minutes = 60 hours). Long-lived bearer tokens significantly increase impact of token theft and replay. Affected files: auth.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com> --- flowsint-core/src/flowsint_core/core/auth.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/flowsint-core/src/flowsint_core/core/auth.py b/flowsint-core/src/flowsint_core/core/auth.py index 6b601bc22..601e2693e 100644 --- a/flowsint-core/src/flowsint_core/core/auth.py +++ b/flowsint-core/src/flowsint_core/core/auth.py @@ -14,7 +14,7 @@ "AUTH_SECRET environment variable is not set. Please set it in your .env file." ) ALGORITHM = "HS256" -ACCESS_TOKEN_EXPIRE_MINUTES = 60 * 60 +ACCESS_TOKEN_EXPIRE_MINUTES = 15 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")