u

src/api/middleware/auth.js

@@ -6,6 +6,16 @@ import { meJson } from '../auth/meJson.js';
 const userCache = new Map();
 const USER_CACHE_TTL = 10 * 60 * 1000;
 
+const TOKEN_COOKIE = {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict',
+};
+
+export function clearTokenCookie(res) {
+    res.clearCookie('token', TOKEN_COOKIE);
+}
+
 export function getCachedUser(email) {
     const cached = userCache.get(email);
     if (cached && cached.expiresAt > Date.now()) {
@@ -57,6 +67,8 @@ export const authMiddleware = async (req, res, next) => {
             if (user) setCachedUser(decoded.email, user);
         }
         if (!user) {
+            if (decoded.email) clearCachedUser(decoded.email);
+            clearTokenCookie(res);
             return authMeJson(res, req, 403, { error: 'User is no longer authorized' });
         }
 
@@ -72,15 +84,14 @@ export const authMiddleware = async (req, res, next) => {
             const { iat, exp, ...payload } = decoded;
             const newToken = jwt.sign(payload, env.jwtSecret, { expiresIn: '1d' });
             res.cookie('token', newToken, {
-                httpOnly: true,
-                secure: true,
-                sameSite: 'strict',
+                ...TOKEN_COOKIE,
                 maxAge: 24 * 60 * 60 * 1000,
             });
         }
 
         next();
     } catch {
+        clearTokenCookie(res);
         return authMeJson(res, req, 401, { error: 'Invalid token' });
     }
 };

src/api/routes/auth/logout.js

@@ -1,6 +1,6 @@
 import jwt from 'jsonwebtoken';
 import env from '../../../config/env.js';
-import { clearCachedUser } from '../../middleware/auth.js';
+import { clearCachedUser, clearTokenCookie } from '../../middleware/auth.js';
 
 /**
  * Registers the logout route (clears session cookie).
@@ -26,11 +26,7 @@ export function register(app, basePath = '') {
             }
         }
 
-        res.clearCookie('token', {
-            httpOnly: true,
-            secure: true,
-            sameSite: 'strict',
-        });
+        clearTokenCookie(res);
         res.status(200).json({ message: 'Logged out successfully' });
     });
 }