JWT Handler Add missing TokenRejectionException

[lanechase34]

Description

The JWT refresh token handler was not catching the TokenRejectionException thrown in jwtService.parseToken()

Updated the setErrorMessage calls to match the latest spec
Response function setErrorMessage( required errorMessage, statusCode )

Updated the actual error messages to not returned detailed response. Sometimes, this goes into too much detail, which could be a potential security risk exposing more information than necessary. Maybe this could use the Coldbox inDebugMode() flag to check and add this, but I'm not sure how to wire that up properly at this moment.

Type of change

• Bug Fix

Checklist

• My code follows the style guidelines of this project cfformat
• I have commented my code, particularly in hard-to-understand areas
• New and existing unit tests pass locally with my changes

[Copilot]

Pull request overview

This PR fixes a missing exception handler in the JWT refresh token endpoint and updates error handling to reduce information exposure. The PR adds a catch block for TokenRejectionException thrown when a token is not found in storage, updates setErrorMessage calls to match the current API signature (removing the third parameter), and improves security by removing detailed error messages that could leak implementation details.

Changes:

• Added TokenRejectionException catch block in handlers/Jwt.cfc to handle tokens rejected by storage validation
• Updated all setErrorMessage calls to use two-parameter signature (message, statusCode) instead of three
• Removed detailed error messages (e.g., #e.message#) to prevent information disclosure
• Enhanced test coverage for invalidated refresh tokens

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
handlers/Jwt.cfc	Added missing TokenRejectionException catch block and simplified error messages by removing the third parameter and detailed exception information
test-harness/tests/specs/integration/JWTSpec.cfc	Updated test to use a valid token that is then invalidated (instead of an invalid token string) to properly test the TokenRejectionException scenario

[Copilot]

This assertion appears redundant - it's comparing the first message from the JSON response to the messages string from the response, which should always match since they're derived from the same source. Consider removing this assertion or clarifying what specific behavior it's validating.