Cookies, session recording and ad conversion measurement improve the product. Before you accept we measure page views and anonymous interactions, with no cookies, no recording and no profile. Reject keeps it that way. Cookie policy

Vetoo
ManifestoLive reviewAgent panelMemory & trustPricing
Resources
Competitor comparisonLearn centerDocs
Sign up
Sign inSign up
The moment a PR opens

Review comments land right where your team already works.

No new dashboard to check. Vetoo posts inline comments straight into the pull request, each flagged with a severity, a reason, and a suggested fix.

acme-inc/web-api

Add refresh token rotation to /auth/session #482

Open

ryan wants to merge 3 commits into main from fix/refresh-token-rotation

R
ryancommented3 minutes ago⋯
Rotates refresh tokens on session renewal so a stolen token cannot be replayed indefinitely. Touches the user lookup in the same handler.

ryan added 3 commits 3 minutes ago

vetoo-reviewbotis queued to review…now
src/auth/session.ts
2626 const user = await db.query(`SELECT * FROM users WHERE token=${token}`)
vetoo-reviewbotcommentedblocking⋯
String-interpolated SQL on the refresh token is injectable. A crafted token could read any row, so bind the value instead of templating it into the query.
Suggested change
− db.query(`SELECT * FROM users WHERE token=${token}`)
+ db.query('SELECT * FROM users WHERE token=$1', [token])
Commit suggestionReply…
src/auth/session.ts
28+ const next = sign(({ id: user.id }, secret)
vetoo-reviewbotcommentednote⋯
The signed token never sets an expiresIn. Three callers assume a 15-minute TTL, and without it refreshed sessions live forever.
Reply…
src/auth/middleware.ts+12−3
src/auth/session.ts+1−0
@@ -24,6 +24,7 @@ async function refreshToken(req, res)
2424async function refreshToken(req, res) {
2525 const token = req.body.refresh_token
2626 const user = await db.query(`SELECT * FROM users WHERE token=${token}`)
Vetoovetoo-reviewbotreviewednowblocking
String-interpolated SQL on the refresh token is injectable. A crafted token could read any row, so bind the value instead of templating it into the query.
Suggested change
− db.query(`SELECT * FROM users WHERE token=${token}`)
+ db.query('SELECT * FROM users WHERE token=$1', [token])
Commit suggestionReply…
2727 if (!user) return res.sendStatus(401)
28+ const next = sign(({ id: user.id }, secret)
Vetoovetoo-reviewbotreviewednownote
The signed token never sets an expiresIn. Three callers assume a 15-minute TTL, and without it refreshed sessions live forever.
Reply…
2829 res.json(({ access_token: next })
2930}
src/routes/users.ts+4−1
Waiting for GitHub webhook…

Reviewers

vetoo-reviewReviewing…

Labels

securityneeds-changes

Review required before merging

Conversations

The review talks back.

Reply to any finding or open a comment with @vetoo-review and it answers in the thread, scoped to your diff. Ask why something is flagged, ask for the fix, push back, or comment review this to trigger a fresh pass. Try a question:

Conversation 0Files changed 1
api-gateway #482open
Waiting for the first question…
Reply to @vetoo-review:

Clear the review queue
before it forms.

Connect your first repository and let Vetoo do the rest.

Connect your repository
Vetoo

Product

ManifestoLive reviewAgent panelMemory & trustPricingFAQ

Resources

All resourcesBenchmarkWhat is AI code review?Code review checklistVetoo vs CodeRabbitVetoo vs GreptileVetoo vs Bugbot

Developers

Docs

Company

AboutContact

Legal

Legal
AI code reviewTry it out