Merge pull request #95 from SOURAV-ROY/sentinel/fix-user-auth-crash-and-production-secrets-enforcement-7215157731352248001

🛡️ Sentinel: Fix potential DoS on deleted users and enforce production secrets

Author: SOURAV-ROY

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-08-14 - JWT Session Orphaning & Denial of Service (DoS) Vulnerability
+**Vulnerability:** Deleting a user from the database while they still possess a valid, unexpired JWT token caused the `protect` middleware to assign `req.user = null`. Downstream middlewares and routes that relied on role validation (e.g., checking `req.user.role`) would attempt to access properties of a null object, throwing a `TypeError` and causing a Denial of Service (DoS) or unexpected system crashes.
+**Learning:** Checking JWT validity (signature and expiration) is insufficient to guarantee that a user is still active and valid. Authenticated routes must always verify that the user fetched from the database is non-null before allowing request execution to proceed.
+**Prevention:** Add a database user presence check `if (!req.user)` directly in the core authentication / token-verification middleware (`protect`) before calling `next()`.

index.js

@@ -23,6 +23,30 @@ const connectDB = require("./db");
 // dotenv.config({path: "./config/config.env"});
 dotenv.config();
 
+// Enforce environment secrets in production and supply secure fallbacks for development/testing
+if (process.env.NODE_ENV === "production") {
+  if (!process.env.SESSION_SECRET) {
+    throw new Error(
+      "CRITICAL SECURITY ERROR: SESSION_SECRET is required in production mode",
+    );
+  }
+  if (!process.env.JWT_SECRET) {
+    throw new Error(
+      "CRITICAL SECURITY ERROR: JWT_SECRET is required in production mode",
+    );
+  }
+} else {
+  // Safe fallbacks for dev/test environments to facilitate local development and testing out-of-the-box
+  process.env.SESSION_SECRET =
+    process.env.SESSION_SECRET ||
+    "dev-session-secret-placeholder-for-testing-only-12345";
+  process.env.JWT_SECRET =
+    process.env.JWT_SECRET ||
+    "dev-jwt-secret-placeholder-for-testing-only-12345";
+  process.env.JWT_EXPIRE = process.env.JWT_EXPIRE || "30d";
+  process.env.JWT_COOKIE_EXPIRE = process.env.JWT_COOKIE_EXPIRE || "30";
+}
+
 //Connect To DB********************************************************
 if (process.env.NODE_ENV !== "test") {
   connectDB().then(() => {

middleware/auth.js

@@ -30,6 +30,13 @@ exports.protect = asyncHandler(async (req, res, next) => {
 
     req.user = await User.findById(decoded.id);
 
+    // Verify user still exists in database (defense in depth & prevents DoS on req.user property accesses)
+    if (!req.user) {
+      return next(
+        new ErrorResponse("Not Authorized to access this route", 401),
+      );
+    }
+
     next();
   } catch (errors) {
     return next(new ErrorResponse("Not Authorized to access this route", 401));

package-lock.json

@@ -33,7 +33,7 @@
     "colors": "^1.4.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "dotenv": "^16.4.5",
+    "dotenv": "^16.6.1",
     "express": "^5.2.1",
     "express-fileupload": "^1.5.1",
     "express-mongo-sanitize": "^2.2.0",