jwt-auth: walk same-named cookies and prefer a live one

lws_jwt_auth_create() took only the first cookie of the configured name.
Browsers legitimately present several same-named cookies at once (host-only
alongside Domain=, or a leftover minted under an earlier cookie-domain
config), ordered oldest-first per RFC 6265, so a stale first cookie shadowed
a live one behind it.  Since every renewal and login re-mints the *other*
scope, the user was stuck "Not logged in" until the stale cookie aged out,
which is what an Android tablet showed against a server whose lws-login
cookie config had recently changed.  The auth server already resolved its
auth_refresh_session this way; the JWT side now does too.

Walk every occurrence (occurrence 0 via the prefix-aware lookup so the
__Host- / __Secure- aliases still work) and return the first that verifies
and is unexpired.  If none is live, return the first that verified, so
callers keep deciding what an expired token means exactly as before; NULL
only when nothing verified.  An oversized occurrence is skipped rather than
ending the search.

Stop such stale duplicates outliving their token: lws-login minted its
renewed auth_session with Max-Age jwt-validity-secs (24h default) although
the JWT inside expires on the auth server's schedule, so a dead cookie could
sit in the jar a day after it stopped verifying.  Cap every auth_session
this plugin mints at the token's own remaining exp; unverifiable or exp-less
tokens fall back to jwt-validity-secs as before.

The status probe diagnostic no longer claims only #0 is consulted.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: lws-team

include/libwebsockets/lws-jwt-auth.h

@@ -39,7 +39,13 @@ typedef int (*lws_jwt_auth_cb_t)(struct lws_jwt_auth *ja, int state, void *user)
  * executes lightweight lejp JSON parsing to extract the exp timestamp and ANY custom grants dictionaries,
  * allocates the tracking object, and registers the proactive SUL timer natively.
  *
- * Returns NULL on failure, or the allocated opaque object on a successful verification.
+ * Browsers can present several same-named cookies at once (host-only
+ * alongside Domain=, or a leftover from an earlier cookie scope), oldest
+ * first.  Every occurrence is tried: the first one that verifies and is
+ * unexpired wins.  If none is live, the first that verified is returned so
+ * the caller decides what an expired token means (check lws_jwt_auth_get_exp()).
+ *
+ * Returns NULL if no occurrence verified, or the allocated opaque object.
  */
 LWS_VISIBLE LWS_EXTERN struct lws_jwt_auth *
 lws_jwt_auth_create(struct lws *wsi, struct lws_jwk *jwk,

lib/jose/jws/jwt-auth.c

@@ -210,38 +210,88 @@ lws_jwt_auth_create(struct lws *wsi, struct lws_jwk *jwk,
 		    lws_jwt_auth_cb_t cb, void *user,
 		    const char **reason)
 {
+	struct lws_jwt_auth *ja = NULL, *cand;
+	uint64_t now = (uint64_t)lws_now_secs();
+	const char *r = NULL, *cr;
 	char jwt[8192];
-	size_t jwt_len = sizeof(jwt);
-	struct lws_jwt_auth *ja;
-	int n;
+	size_t jwt_len;
+	int n = 0, m;
+
+	/*
+	 * Browsers legitimately present several same-named cookies at once
+	 * (host-only alongside Domain=, or a leftover minted under an earlier
+	 * cookie-domain config), ordered oldest-first per RFC 6265.  Taking
+	 * only the first lets a stale one shadow a live one sitting behind it
+	 * in the same header, and since every renewal and login re-mints the
+	 * *other* scope, the user stays "not logged in" until the stale cookie
+	 * ages out.  So walk every occurrence and take the first that
+	 * verifies and is unexpired.  If none is live, return the first that
+	 * verified: what an expired token means is the caller's decision,
+	 * exactly as before.  NULL only when nothing verified at all.
+	 */
+	for (;;) {
+		jwt_len = sizeof(jwt);
+		if (!n)
+			/*
+			 * occurrence 0 via the prefix-aware lookup, so the
+			 * __Host- / __Secure- aliases keep working when no
+			 * plain-named cookie exists
+			 */
+			m = lws_http_cookie_get(wsi, cookie_name, jwt, &jwt_len);
+		else
+			m = lws_http_cookie_get_nth(wsi, cookie_name, n, jwt,
+						    &jwt_len);
+		if (m) {
+			if (!r)
+				r = m == 2 ? "Cookie value too large for buffer" :
+					     "Cookie not found";
+			if (m != 2)
+				break; /* no more occurrences */
+			n++; /* oversized: skip it, look behind it */
+			continue;
+		}
 
-	n = lws_http_cookie_get(wsi, cookie_name, jwt, &jwt_len);
-	if (n) {
-		if (reason)
-			*reason = n == 2 ? "Cookie value too large for buffer" :
-					   "Cookie not found";
-		return NULL;
-	}
+		cand = lws_zalloc(sizeof(*cand), __func__);
+		if (!cand) {
+			r = "OOM";
+			break;
+		}
 
-	ja = lws_zalloc(sizeof(*ja), __func__);
-	if (!ja) {
-		if (reason)
-			*reason = "OOM";
-		return NULL;
-	}
+		cand->cx = lws_get_context(wsi);
+		cand->wsi = wsi;
+		cand->jwk = jwk;
+		cand->cb = cb;
+		cand->user = user;
+		lws_strncpy(cand->cookie_name, cookie_name,
+			    sizeof(cand->cookie_name));
+
+		cr = NULL;
+		if (lws_jwt_auth_update(cand, jwt, &cr)) {
+			if (!r)
+				r = cr;
+			lws_jwt_auth_destroy(&cand);
+			n++;
+			continue;
+		}
 
-	ja->cx = lws_get_context(wsi);
-	ja->wsi = wsi;
-	ja->jwk = jwk;
-	ja->cb = cb;
-	ja->user = user;
-	lws_strncpy(ja->cookie_name, cookie_name, sizeof(ja->cookie_name));
+		if (!cand->exp || cand->exp > now) {
+			/* live: this is the one, drop any expired fallback */
+			if (ja)
+				lws_jwt_auth_destroy(&ja);
+			ja = cand;
+			break;
+		}
 
-	if (lws_jwt_auth_update(ja, jwt, reason)) {
-		lws_free(ja);
-		return NULL;
+		if (!ja)
+			ja = cand; /* verified but expired: fallback only */
+		else
+			lws_jwt_auth_destroy(&cand);
+		n++;
 	}
 
+	if (!ja && reason)
+		*reason = r ? r : "Cookie not found";
+
 	return ja;
 }
 

plugins/protocol_lws_login/protocol_lws_login.c

@@ -750,6 +750,41 @@ lws_login_kick_refresh_selfheal(struct vhd_login *vhd, struct lws *wsi,
 	return kicked;
 }
 
+/*
+ * Max-Age for a cookie carrying token: the smaller of jwt-validity-secs and
+ * the token's own remaining lifetime.  A cookie that outlives the JWT inside
+ * it is pure liability: it can only ever fail verification, and if the
+ * browser orders it ahead of a live same-named cookie (host-only vs Domain=
+ * scope) it shadows that one.  A token we cannot verify or that carries no
+ * exp falls back to jwt-validity-secs, exactly as before.
+ */
+static unsigned long long
+lws_login_token_max_age(struct lws *wsi, struct vhd_login *vhd,
+			const char *token)
+{
+	uint64_t now = (uint64_t)lws_now_secs(), exp;
+	char temp[2048], out[2048];
+	size_t out_len = sizeof(out), alen;
+	const char *v;
+
+	if (lws_jwt_signed_validate(lws_get_context(wsi), &vhd->jwk,
+			"ES256,ES384,ES512,RS256,RS384,RS512,HS256", token,
+			strlen(token), temp, sizeof(temp), out, &out_len))
+		return (unsigned long long)vhd->jwt_validity_secs;
+
+	v = lws_json_simple_find(out, out_len, "\"exp\":", &alen);
+	if (!v)
+		return (unsigned long long)vhd->jwt_validity_secs;
+
+	exp = (uint64_t)atoll(v);
+	if (exp <= now + 1)
+		return 1;
+	if (exp - now < vhd->jwt_validity_secs)
+		return (unsigned long long)(exp - now);
+
+	return (unsigned long long)vhd->jwt_validity_secs;
+}
+
 /*
  * Serve the protected page to the browser by re-issuing the JWT cookie and
  * 302-ing back to the same URL the browser originally asked for.  Used by:
@@ -791,8 +826,7 @@ lws_login_serve_self_redirect_with_cookie(struct lws *wsi, struct pss_login *pss
 	if (lws_http_cookie_compose(cookie, sizeof(cookie),
 				     vhd->cookie_name, token,
 				     vhd->cookie_domain,
-				     (unsigned long long)
-							vhd->jwt_validity_secs,
+				     lws_login_token_max_age(wsi, vhd, token),
 				     NULL) < 0) {
 		lwsl_wsi_err(wsi, "%s: %s Set-Cookie too large for the "
 			     "composed buffer (token %d, domain %d)",
@@ -1286,15 +1320,15 @@ simple_response(struct lws *wsi, struct pss_login *pss, const char *msg, const c
  * in" widget always makes, and bots scanning the mount never do, so it
  * cannot become log spam.
  *
- * lws_jwt_auth_create() only ever looks at the FIRST cookie of the configured
- * name, but browsers legitimately hold several same-named cookies at once
- * (host-only alongside Domain=, or leftovers minted under an earlier
- * cookie-domain config), ordered oldest-first per RFC 6265, so a stale value
- * can shadow a live one sitting behind it in the same Cookie header.  Walk
- * every occurrence and verify each against our JWK, so the log says which of
- * "no cookie", "signature does not verify", "expired" or "shadowed by a
- * stale duplicate" applies.  None of that is observable on the device (eg a
- * tablet), and without it the not-logged-in widget is undiagnosable.
+ * Browsers legitimately hold several same-named cookies at once (host-only
+ * alongside Domain=, or leftovers minted under an earlier cookie-domain
+ * config), ordered oldest-first per RFC 6265.  lws_jwt_auth_create() walks
+ * them all and prefers a live one, but a jar full of stale duplicates is
+ * still worth knowing about, so walk every occurrence and verify each
+ * against our JWK: the log then says which of "no cookie", "signature does
+ * not verify" or "expired" applies, per cookie.  None of that is observable
+ * on the device (eg a tablet), and without it the not-logged-in widget is
+ * undiagnosable.
  */
 static void
 lws_login_diag_jar(struct lws *wsi, struct vhd_login *vhd)
@@ -1401,10 +1435,9 @@ lws_login_diag_jar(struct lws *wsi, struct vhd_login *vhd)
 
 	if (n > 1)
 		lwsl_wsi_notice(wsi, "status probe: %d same-named '%s' cookies "
-			"presented but only #0 is ever consulted: a stale #0 "
-			"shadows any live one behind it (host-only vs Domain= "
-			"scope, or a leftover from an earlier cookie-domain "
-			"config)", n, vhd->cookie_name);
+			"presented, none live (host-only vs Domain= scope, or "
+			"a leftover from an earlier cookie-domain config)",
+			n, vhd->cookie_name);
 	else if (expired)
 		lwsl_wsi_notice(wsi, "status probe: single expired '%s' JWT, "
 			"expect the widget's silent renewal to re-mint it next",
@@ -2729,8 +2762,9 @@ callback_lws_login(struct lws *wsi, enum lws_callback_reasons reason,
 							vhd->cookie_name,
 							pss->silent_update_jwt,
 							vhd->cookie_domain,
-							(unsigned long long)
-								vhd->jwt_validity_secs,
+							lws_login_token_max_age(
+								wsi, vhd,
+								pss->silent_update_jwt),
 							NULL) < 0) {
 						lwsl_wsi_err(wsi, "%s: %s "
 							     "Set-Cookie too "
@@ -2949,8 +2983,8 @@ callback_lws_login(struct lws *wsi, enum lws_callback_reasons reason,
 							    vhd->cookie_name,
 							    ps->token,
 							    vhd->cookie_domain,
-							    (unsigned long long)
-								vhd->jwt_validity_secs,
+							    lws_login_token_max_age(
+								wsi, vhd, ps->token),
 							    NULL);
 				if (n < 0) {
 					lwsl_wsi_err(wsi, "%s: %s Set-Cookie "

plugins/protocol_lws_login/protocol_lws_login.md

@@ -228,12 +228,14 @@ at `notice` exactly what the request carried, attributed to the wsi:
    verifies against `jwt-jwk`, and if so its `sub` and whether it is live or
    how long ago it expired.
 
-The second point matters because `lws_jwt_auth_create()` only ever consults
-the first cookie of that name, while browsers legitimately hold several at
-once (host-only alongside `Domain=`, or leftovers minted under an earlier
-`cookie-domain` config) ordered oldest-first, so a stale first cookie can
-shadow a live one behind it: every renewal and login re-mints the *other*
-scope and the widget stays "Not logged in" until the stale one ages out.
-The probe log calls that case out explicitly.  Only the status probe emits
-these lines, since it is the one request a not-logged-in widget always makes
-and scanners never do.
+The second point matters because browsers legitimately hold several
+same-named cookies at once (host-only alongside `Domain=`, or leftovers
+minted under an earlier `cookie-domain` config), ordered oldest-first.
+`lws_jwt_auth_create()` walks every occurrence and uses the first that
+verifies and is unexpired, so a stale duplicate cannot shadow a live one;
+before that, a stale first cookie left the widget "Not logged in" until it
+aged out, since every renewal and login re-minted the *other* scope.  To
+stop such stale duplicates accumulating, every `auth_session` cookie this
+plugin mints has its `Max-Age` capped at the JWT's own remaining `exp`, never
+just `jwt-validity-secs`.  Only the status probe emits these lines, since it
+is the one request a not-logged-in widget always makes and scanners never do.