Scan your domain. Get the prompts to fix it in Claude Code.

# Fix: SQUR-0007 — JWT expiry claim not validated

**Severity:** High · **Location:** `src/api/auth/verify.ts:42` · **Class:** CWE-613 (Insufficient Session Expiration)

## Context
SQUR's agent issued a token, waited past its stated lifetime, and replayed it. The request
succeeded. `verifyToken()` decodes the JWT and checks the signature, but never checks the
`exp` claim. Expired tokens stay valid forever.

## Prompt for Claude Code / Cursor / Copilot

> In `src/api/auth/verify.ts`, the `verifyToken` function at line 38 to 50 verifies the JWT
> signature with `jwt.verify(token, secret)` but does not validate the `exp` claim, so expired
> tokens are still accepted.
>
> Refactor it so that:
> 1. `exp` is validated against the current time using the existing `jsonwebtoken` library
>    (do not hand-roll the check — pass the verify options so `jsonwebtoken` enforces `exp`).
> 2. An expired token rejects with a 401 and the body `{ error: "token_expired" }`.
> 3. A token missing an `exp` claim is treated as invalid, not as never-expiring.
> 4. Existing valid-token behaviour and the current error handling are preserved.
>
> Add tests in `tests/api/auth/verify.test.ts` that assert:
> - A token issued with a 1-second lifetime is rejected after it expires (use fake timers).
> - A token with no `exp` claim is rejected with 401.
> - A fresh, valid token still passes.
>
> Show me the diff before writing any files.

## Why this prompt works
- Names the exact file and line range, so the tool does not guess.
- Tells the LLM to use the existing library instead of writing custom date math.
- Bakes the verification into the prompt as tests.
- Asks for the diff first, so you review before anything changes.

## After applying
Run your free re-scan (included with the Fix Kit) to confirm SQUR-0007 is resolved.
The re-scan link is at the bottom of your delivery email.