[BUG] User data confidentiality compromised!

[Adeleye080]

Describe the problem

I could access a new access token using just a simple uuid string given as a refresh-token upon login. This is a dangerous bug that needs quick fix.

Concerned endpoints

• /user/refresh_token
• /user/login

Steps to reproduce the problem

1. POST request to the first concerned endpoint

Screenshot (If applicable)

Expected behavior

Refresh token should be a JWT string that is encoded by server and decoded with server secret upon POST request to the first concerned endpoint. This is crucial to maintain security, so that accounts won't be compromised.

Solution

• Return refresh token (JWT) upon login alongside access token(JWT) and decode refresh token upon access to the first concerned endpoint

[rohteemie]

Kindly provide a more descriptive analysis of the problem in detail, please.