🐛 Bug Report: JWT still valid after Session Timeout

The problem

Issue appwrite/appwrite#8000 (closed, 69 comments): ### 👟 Reproduction steps I use JWT to authenticate a user on my API server. I use the /account endpoint to verify the JWT. If the user is logged out because the session has expired, the JWT is still valid and I still get a successful response when I call /account with the user's JWT. ### 👍 Expected behavior The JWT should be invalid after the user is logged out and calling /account with users JWT should throw an error.

The fix

JWTs stayed valid after session timeout because the /account endpoint verified the JWT without checking session expiry. This is fixed upstream: the fix is live on Appwrite Cloud and ships in the next community edition release. If you self-host, upgrade to the release containing the fix. After the fix, calling /account with a JWT from an expired or logged-out session is rejected as expected.

Notes

Thread: https://github.com/appwrite/appwrite/issues/8000. Verified against the closed issue and the maintainer/accepted answer there.

In https://github.com/appwrite/appwrite/issues/8000, the reporter asked: Issue appwrite/appwrite#8000 (closed, 69 comments): ### 👟 Reproduction steps I use JWT to authenticate a user on my API server. I use the /account endpoint to verify the JWT. If the user is logged out because the session has expired, the JWT is still valid and I still get a successful response when I call /account with the user's JWT. ### 👍 Expected behavior The JWT should be invalid after the user is logged out and calling /account with users JWT should throw an error. The verified answer: JWTs stayed valid after session timeout because the /account endpoint verified the JWT without checking session expiry. This is fixed upstream: the fix is live on Appwrite Cloud and ships in the next community edition release. If you self-host, upgrade to the release containing the fix. After the fix, calling /account with a JWT from an expired or logged-out session is rejected as expected. Source thread: https://github.com/appwrite/appwrite/issues/8000