No Session Timeout
Sessions that never expire stay valid indefinitely, giving attackers unlimited time to use stolen tokens.
How It Works
If a JWT or session token has no expiry, a token stolen from a breach, a leaked log, or a compromised device remains valid forever. The attacker can return months later and the token still works. Session timeouts limit the window of opportunity even when a token is compromised.
// BAD: JWT with no expiry — valid forever
const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET!);
// No expiresIn — this token never expires// GOOD: short-lived access token + refresh token pattern
const accessToken = jwt.sign(
{ userId: user.id },
process.env.JWT_SECRET!,
{ expiresIn: '15m' } // short-lived access token
);
const refreshToken = generateSecureToken(); // stored in DB with 30-day expiry
// Client uses refresh token to get new access tokens silentlyReal-World Example
The 2020 Zoom security audit found that some tokens had no expiry configured. Security researchers demonstrated that a token from a year-old log entry was still valid, allowing them to authenticate as users who had long since changed their passwords.
How to Prevent It
- Set a short expiry on JWTs (15-60 minutes) and implement a refresh token flow
- Implement absolute session timeout (e.g., 30 days maximum) regardless of activity
- Implement idle session timeout (e.g., 2 hours of inactivity) for sensitive applications
- Store refresh tokens in the database so they can be revoked server-side
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
NODE_ENV Not Set to Production
mediumRunning Node.js without NODE_ENV=production enables verbose error messages, disables caching optimizations, and can activate development-only middleware.
Debug Mode Active in Production
mediumDebug mode enabled in production exposes internal state, enables verbose logging, and sometimes activates interactive debugging endpoints that attackers can exploit.
No Health Check Endpoint
lowWithout a /health endpoint, load balancers and orchestrators can't verify your application is actually working before routing traffic to it.
No Error Monitoring
lowWithout error monitoring, production errors are invisible until a user reports them — which most never do.