The Token That Never Expired

Security sets session TTL to 15 minutes. A stolen cookie still works hours later. Audit shows expiresAt written correctly at login. The authorize path never reads it.

Initial failing signalexpired session still authorizesExpected behavior: An expired session is rejected. · actual behavior: An expired session is still authorized.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Create a session with expiresAt in the past.
Call isSessionValid for that token.
Authorization should deny the request.

Focus Mode

Start

src/session.ts
src/authorize.ts

Likely area

src/session.ts
src/authorize.ts
src/store.ts

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicAuth & Sessions

DifficultyMedium

Est. time15 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace