Skip to content

fix: implement token expiration check in folksonomy API#457

Open
SaitejaKommi wants to merge 2 commits intoopenfoodfacts:mainfrom
SaitejaKommi:fix/token-expiration-validation
Open

fix: implement token expiration check in folksonomy API#457
SaitejaKommi wants to merge 2 commits intoopenfoodfacts:mainfrom
SaitejaKommi:fix/token-expiration-validation

Conversation

@SaitejaKommi
Copy link
Copy Markdown
Contributor

Description

Implements token expiration validation to prevent using stale tokens in the folksonomy API.

Problem Solved

Previously, tokens were saved with timestamps but never validated for expiration, causing:

  • Using stale tokens beyond their validity
  • Unnecessary 401 errors from the API
  • Silent authentication failures

Solution

Added expiration checking logic that:

  1. Validates token age when retrieving from localStorage
  2. Returns null if token is > 1 hour old
  3. Automatically cleans up expired tokens
  4. Triggers fresh authentication immediately

How Has This Been Tested?

  • 3 new test cases added in src/api/folksonomy.test.ts
  • Tests for expired tokens, fresh tokens, and cleanup
  • All tests pass locally

Changes Made

  1. src/api/folksonomy.ts

    • Added TOKEN_MAX_AGE_MS = 3600000 (1 hour)
    • Modified getStoredToken() to validate token age
    • Clears localStorage when token expires
  2. src/api/folksonomy.test.ts

    • Added 3 new test cases for token expiration

Security Impact

✓ Reduces token exposure time
✓ Aligns with OAuth 2.0 best practices
✓ Requires fresh authentication every hour

Fixes #456

@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 3, 2026

@SaitejaKommi is attempting to deploy a commit to the openfoodfacts Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

fix: implement token expiration check in folksonomy API

2 participants