PLAN_002 Token expiration in user authentication process

Description

Handling expired access tokens properly in a software system is important for maintaining security and protecting sensitive information. Access tokens are used to authenticate users and authorize their actions within the system. If expired tokens are not managed correctly, unauthorized users could potentially gain access by using old tokens, leading to security breaches, data theft, or other malicious activities.

The recommended expiration time for access tokens balances security and usability. Shorter expiration times, such as 15 minutes to an hour, enhance security by reducing the window of opportunity for token misuse. However, they can also inconvenience users by requiring frequent re-authentication. A common approach is to use tokens with an expiration time of about an hour, combined with refresh tokens that can obtain new short-lived access tokens without requiring the user to re-authenticate frequently.

System requirements

No special hardware or software is required to run this test.

Preconditions

• The entire system (including the reverse proxy, REST API, and all upstream services) is deployed, operational, and accessible online.
• All communications with the REST API are conducted over HTTPS, either through a reverse proxy server or directly with the hosting server.
• The user database includes at least one test account with an encrypted password.
• The token expiration time has been set to 1 hour.

Input data

Use the following authentication credentials for this test:

• Username: testuser@legit.api
• Password: @634&lMjH52#ipK@

To log in, please send your credentials to the authentication endpoint as Form-data. Use the keys username and password to submit your information. Here’s how you can format your request:

{
    "username": *Your username*,
    "password": *Your password*,
}

Make sure to select Form-data as the type of request body when sending your credentials. This format ensures that your login information is properly received and processed by the endpoint.

Steps

1. Log in with the provided credentials to obtain an access token.
2. Wait for the token to expire.
3. Attempt to access a protected endpoint with the expired token.

Expected outcome

• The REST API returns a valid token when sending the authentication credentials.
• The REST API rejects the access attempt with an expired token, returning a 401 Unauthorized status code along with an appropriate error message.

Verifies software requirements

• REQ_005

Risk control for

• 16. An organisation that is not a licensed care provider gets access to the device
• 17. Users outside the inteded user definition use the medical device
• 26. Data breach or unauthorized access

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Tester: JD-017, JD-009, JD-004
• Approver: JD-005