Context-Aware Validation & Advanced Token Lifecycle Management

Welcome to the final lesson of our course on securing your TypeScript REST API. In this lesson, we will explore context-aware validation and advanced token lifecycle management. These techniques are crucial for preventing token abuse and enhancing the security of your API. By the end of this lesson, you will understand how to implement role-based access control, token revocation, and IP address validation to secure your API effectively.

Context-aware validation goes beyond basic token verification by considering additional factors surrounding the token usage. While standard validation simply verifies that a token is valid and not expired, context-aware validation examines:

1. Who is using the token (user identity and role)
2. Where the token is being used from (IP address, device)
3. What the token is trying to access (resource permissions)
4. When the token is being used (time restrictions)
5. How the token is being presented (header format, encryption)

This multi-dimensional approach creates security boundaries that are much harder to breach, even if a token is compromised.

Token lifecycle management involves controlled processes for:

1. Token Creation: Generating tokens with appropriate claims and contexts
2. Token Storage: Securely storing tokens on both client and server sides
3. Token Validation: Verifying tokens against multiple contextual factors
4. Token Renewal: Safely refreshing tokens without security compromises
5. Token Revocation: Invalidating tokens that are no longer trusted

Implementing proper lifecycle management ensures that your tokens remain secure throughout their existence and can be properly invalidated when necessary.

Role-Based Access Control (RBAC) is a method of restricting access to resources based on the roles of individual users. In our API, we use the roleRequired middleware function to enforce RBAC. Here's how it works:

export function roleRequired(requiredRole: Role) {
  return (req: Request, res: Response, next: NextFunction) => {
    const authHeader = req.headers.authorization || '';
    const token = authHeader.split(' ')[1];
    if (!token) {
      return res.status(401).json({ error: 'Missing token' });
    }

    try {
      const decoded = jwt.verify(token, JWT_SECRET_KEY) as any;
      if (decoded.role !== requiredRole.toString()) {
        return res.status(403).json({ error: 'Insufficient privileges' });
      }
      req.user = decoded;
      next();
    } catch (err) {
      return res.status(401).json({ error: 'Invalid or expired token' });
    }
  };
}

The key logic here is that this middleware extracts the user's role from the JWT token and compares it against the required role for the route. The function returns a middleware that can be applied to any route, with the required role passed as an argument. If the user's role doesn't match what's required, access is denied with a 403 status code.