Subscription status is verified server-side

JWTs and session cookies have fixed expiry windows. If a subscription lapses between token issuances, the user retains premium access until their next login — potentially days or weeks. CWE-613 (Insufficient Session Expiration) and CWE-602 (Client-Side Enforcement of Server-Side Security) both apply. NIST AC-3 (Access Enforcement) requires that access decisions happen at the enforcement point, not at authentication time. Reading subscription status from the database on each request is the only way to ensure that a cancellation or failed payment takes effect immediately.

Read subscription status from the database on every protected request, not from the session token. For performance, a short-lived server-side cache (60 seconds) is acceptable; caching in the JWT is not.

// middleware.ts or a shared access-check utility
const user = await db.user.findUnique({
  where: { id: session.userId },
  select: { subscription_status: true, plan: true }
})

if (!user || !['active', 'trialing'].includes(user.subscription_status)) {
  return redirect('/billing/upgrade')
}

Also ensure the set of statuses that grant access (active, trialing, etc.) is identical across all enforcement points — middleware, API routes, Server Actions, and UI components. Inconsistent status lists are a FAIL even if each individual check is server-side.