akinder volunteer testing

The application issues JWT (Bearer) tokens with an excessively long expiration period (~1 year). This increases the risk of prolonged unauthorized access if the token is leaked, intercepted, or exposed.
JWT tokens are meant to be short-lived. A long expiry defeats the purpose of secure session handling and increases the attack window significantly.

Steps to Reproduce
Authenticate to the application
Capture the JWT token from request headers (Authorization: Bearer)
Decode the token using any JWT decoder
Observe the exp (expiration) claim
Compare with iat → duration is ~1 year

Proof of Concept
Example exp: 1808332074
Converted expiry: 20 April 2027 (~1 year validity)