Implement Refresh Token #317
Conversation
|
|
WalkthroughThe changes implement a refresh token mechanism for authentication in the application, enhancing token management by introducing distinct access and refresh tokens. Modifications include updates to environment variables, authentication controller logic, service methods, and client-side token handling. New methods for token generation and validation are added, ensuring a seamless authentication process and improved security. Changes
Assessment against linked issues
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Outside diff range, codebase verification and nitpick comments (1)
backend/src/auth/jwt-refresh.strategy.ts (1)
1-26: Consider using optional chaining injwtFromRequest.The current implementation of the
jwtFromRequestfunction uses a traditional conditional check. You can simplify this by using optional chaining:
- Update the line
if (req && req.body.refreshToken)toif (req?.body?.refreshToken).This change will make the code more concise and modern.
- Location:
backend/src/auth/jwt-refresh.strategy.ts, line 10.Analysis chain
Implement
JwtRefreshStrategy.The implementation of
JwtRefreshStrategyis comprehensive and aligns with the objectives of securely handling refresh tokens. The use ofconfigService.getfor the secret key is a good practice for secure configuration management.However, consider the static analysis hint:
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the use of optional chaining in jwtFromRequest. # Test: Search for the jwtFromRequest implementation. Expect: Use of optional chaining. ast-grep --lang typescript --pattern $'jwtFromRequest: (req) => { if (req && req.body.refreshToken) { return req.body.refreshToken } return null }'Length of output: 158
Script:
#!/bin/bash # Description: Search for the jwtFromRequest function and check for the use of optional chaining. # Search for the jwtFromRequest function in the codebase. rg 'jwtFromRequest: \(req\) => {' -A 3Length of output: 160
Script:
#!/bin/bash # Description: Search for the jwtFromRequest function and check for the use of optional chaining. # Corrected search pattern for the jwtFromRequest function in the codebase. rg 'jwtFromRequest: \(req\) => \{' -A 3Length of output: 316
Tools
Biome
[error] 13-13: Change to an optional chain.
Unsafe fix: Change to an optional chain.
(lint/complexity/useOptionalChain)
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (14)
- backend/.env.development (1 hunks)
- backend/src/auth/auth.controller.ts (2 hunks)
- backend/src/auth/auth.module.ts (2 hunks)
- backend/src/auth/auth.service.spec.ts (1 hunks)
- backend/src/auth/auth.service.ts (1 hunks)
- backend/src/auth/jwt-refresh.strategy.ts (1 hunks)
- backend/src/auth/jwt.strategy.ts (1 hunks)
- backend/src/auth/types/login-response.type.ts (1 hunks)
- backend/src/auth/types/refresh-token-request.type.ts (1 hunks)
- frontend/src/App.tsx (4 hunks)
- frontend/src/components/popovers/ProfilePopover.tsx (3 hunks)
- frontend/src/hooks/api/user.ts (2 hunks)
- frontend/src/pages/auth/callback/Index.tsx (1 hunks)
- frontend/src/store/authSlice.ts (2 hunks)
Additional context used
Biome
backend/src/auth/jwt-refresh.strategy.ts
[error] 13-13: Change to an optional chain.
Unsafe fix: Change to an optional chain.
(lint/complexity/useOptionalChain)
Additional comments not posted (27)
backend/src/auth/jwt.strategy.ts (1)
9-14: Approve changes in JWT strategy, but verify configuration alignment.The changes are appropriate for distinguishing the JWT strategy. Ensure that the
JWT_ACCESS_TOKEN_SECRETis consistently used across all parts of the system where JWTs are handled.Run the following script to verify the usage of
JWT_ACCESS_TOKEN_SECRETacross the project:Verification successful
JWT secret key usage is consistent across authentication components.
The
JWT_ACCESS_TOKEN_SECRETis consistently used in bothjwt.strategy.tsandauth.module.ts, ensuring alignment in the JWT authentication setup. No further issues were found.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the consistent use of `JWT_ACCESS_TOKEN_SECRET` across the project. # Test: Search for the secret key usage. Expect: Consistent usage across all relevant files. rg --type typescript "JWT_ACCESS_TOKEN_SECRET"Length of output: 81
Script:
#!/bin/bash # Description: Verify the consistent use of `JWT_ACCESS_TOKEN_SECRET` across the project. # Test: Search for the secret key usage. Expect: Consistent usage across all relevant files. rg --type ts "JWT_ACCESS_TOKEN_SECRET"Length of output: 240
frontend/src/pages/auth/callback/Index.tsx (4)
5-5: Update imports to includesetRefreshToken.The import statement has been correctly updated to include
setRefreshTokenwhich is necessary for the new functionality.
13-14: Retrieve bothaccessTokenandrefreshToken.The code correctly retrieves both tokens from the URL search parameters, aligning with the new authentication flow.
16-16: Redirect if tokens are missing.This conditional check ensures that both tokens must be present, otherwise, it redirects to the home page. This is a good security practice to prevent unauthorized access.
21-22: Dispatch tokens to the Redux store.Tokens are correctly dispatched to the Redux store, ensuring that they are available throughout the application.
frontend/src/store/authSlice.ts (4)
7-7: AddrefreshTokentoAuthState.Adding
refreshTokento theAuthStateis necessary for managing the refresh token's state across the application.
12-12: InitializerefreshTokenin theinitialState.Initializing
refreshTokentonullin theinitialStateis correct and aligns with the handling of theaccessToken.
22-24: ImplementsetRefreshTokenreducer.The
setRefreshTokenfunction is correctly implemented to update therefreshTokenstate based on the action's payload.
28-28: ExportsetRefreshToken.Including
setRefreshTokenin the exported actions allows it to be dispatched from components, which is necessary for the new functionality.backend/src/auth/auth.module.ts (3)
6-8: Import order and new strategy addition.The import of
JwtRefreshStrategyis correctly placed and aligns with the new functionality for handling refresh tokens.
27-27: Updated providers list with new strategy.The addition of
JwtRefreshStrategyto the providers list is crucial for enabling refresh token functionality. This change is consistent with the PR objectives.
18-21: Dynamic JWT configuration.The use of
ConfigServiceto dynamically set JWT expiration times and secrets enhances flexibility and maintainability. Ensure that the configuration values are properly set in the environment or configuration files.Run the following script to verify the configuration settings:
backend/src/auth/auth.service.ts (3)
10-14: Constructor enhancements with new dependencies.The addition of
JwtServiceandConfigServiceto the constructor is essential for handling JWT operations and configuration settings. This change supports the new token management functionality.
35-44: New method for access token renewal.The
getNewAccessTokenmethod efficiently handles the generation of a new access token using a refresh token. This method is crucial for maintaining user sessions without frequent re-authentications.
16-33: New method for GitHub authentication.The
loginWithGithubmethod correctly handles user authentication via GitHub and manages both access and refresh tokens. Ensure that error handling is robust, especially in user creation and token generation processes.Run the following script to verify error handling in the
loginWithGithubmethod:backend/src/auth/auth.controller.ts (3)
24-25: Dependency update in constructor.The shift to using
authServicecentralizes authentication logic, which is a positive change for maintainability and modularity.
39-42: Updated login method logic.The updated
loginmethod now correctly handles the redirection with both access and refresh tokens. This change enhances the client-side handling of authentication states.
47-55: New method for token refresh.The
refreshmethod provides a structured way to renew access tokens, which is essential for secure and continuous user sessions. Ensure that theAuthGuardis properly configured to protect this endpoint.Run the following script to verify the
AuthGuardconfiguration for therefreshmethod:Verification successful
AuthGuard Configuration Verified for Refresh Method
The
AuthGuardis correctly configured to use the "refresh" strategy in therefreshmethod. The implementation ofJwtRefreshStrategyconfirms that the necessary setup is in place to protect the endpoint.
backend/src/auth/jwt-refresh.strategy.ts: Implementation ofJwtRefreshStrategyfor the "refresh" strategy.backend/src/auth/auth.controller.ts: Usage ofAuthGuard("refresh")in therefreshmethod.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify `AuthGuard` configuration for the `refresh` method. # Test: Search for `AuthGuard` configuration. Expect: Proper guard settings. rg --type python 'AuthGuard' backend/src/auth/auth.controller.tsLength of output: 95
Script:
#!/bin/bash # Description: Verify `AuthGuard` configuration for the `refresh` method. # Test: Search for `AuthGuard` configuration. Expect: Proper guard settings. rg 'AuthGuard' backend/src/auth/auth.controller.tsLength of output: 163
Script:
#!/bin/bash # Description: Verify the implementation of the "refresh" strategy used by AuthGuard. # Test: Search for the implementation or configuration of the "refresh" strategy. rg 'refresh' --type typescriptLength of output: 65
Script:
#!/bin/bash # Description: Verify the implementation of the "refresh" strategy used by AuthGuard. # Test: Search for the implementation or configuration of the "refresh" strategy. rg 'refresh' --glob '*.ts'Length of output: 2320
frontend/src/hooks/api/user.ts (2)
5-5: Approved: Enhanced import for refresh token management.The addition of
setRefreshTokento the imports supports the new functionality of managing refresh tokens, aligning with the PR's objectives to improve authentication flows.
35-35: Approved: Robust error handling inuseGetUserQuery.The inclusion of
setRefreshToken(null)ensures that refresh tokens are cleared alongside access tokens and user data upon encountering a query error, enhancing the security and consistency of the state management.backend/src/auth/auth.service.spec.ts (3)
1-1: Approved: Enhanced configuration handling withConfigModule.The import of
ConfigModulesupports a more modular and manageable configuration setup, which is beneficial for maintaining scalable and clean code.
13-31: Approved: Comprehensive mocking for dependency isolation in tests.The introduction of mocks for
UsersServiceandJwtServiceallows for more controlled and isolated testing of theAuthService, ensuring that the tests are not dependent on actual implementations and can focus on behavior verification.
42-63: Approved: Thorough testing for new access token generation.The tests for
getNewAccessTokeneffectively verify both the successful token generation and error handling scenarios, ensuring theAuthServicebehaves as expected under various conditions.frontend/src/components/popovers/ProfilePopover.tsx (2)
16-16: Approved: Enhanced import for refresh token management in logout process.The addition of
setRefreshTokento the imports supports the updated logout functionality, ensuring that refresh tokens are properly managed during user logout.
27-27: Approved: Enhanced security in logout functionality.The update to
handleLogoutto includesetRefreshToken(null)ensures that all session tokens are cleared upon logout, enhancing the security and consistency of the application's state management.backend/.env.development (1)
19-22: Review of new JWT configuration variables.The renaming of
JWT_AUTH_SECRETtoJWT_ACCESS_TOKEN_SECRETand the addition ofJWT_ACCESS_TOKEN_EXPIRATION_TIME,JWT_REFRESH_TOKEN_SECRET, andJWT_REFRESH_TOKEN_EXPIRATION_TIMEare correctly implemented and align with the PR's objectives to enhance token management.frontend/src/App.tsx (1)
102-141: Review of Axios interceptor implementation for token management.The implementation of the Axios interceptor to handle 401 errors and refresh tokens is well-done. It correctly identifies when to attempt a token refresh and when to clear tokens and user data. This is crucial for maintaining user sessions and enhancing security.
However, ensure that the interceptor is properly cleaned up when the component unmounts to prevent memory leaks or unintended behavior.
|
I think there are still a few tasks left.
Can you let me know if there is a good solution? |
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- backend/.env.development (1 hunks)
Files skipped from review as they are similar to previous changes (1)
- backend/.env.development
There was a problem hiding this comment.
Actionable comments posted: 2
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (10)
- backend/src/auth/auth.controller.ts (2 hunks)
- backend/src/auth/auth.service.ts (1 hunks)
- backend/src/auth/dto/refresh-token-request.dto.ts (1 hunks)
- backend/src/auth/dto/refresh-token-response.dto.ts (1 hunks)
- backend/src/auth/types/login-response.type.ts (1 hunks)
- backend/src/users/users.module.ts (1 hunks)
- frontend/src/App.tsx (4 hunks)
- frontend/src/components/popovers/ProfilePopover.tsx (2 hunks)
- frontend/src/hooks/api/user.ts (2 hunks)
- frontend/src/store/authSlice.ts (2 hunks)
Files skipped from review due to trivial changes (3)
- backend/src/auth/dto/refresh-token-request.dto.ts
- backend/src/auth/dto/refresh-token-response.dto.ts
- backend/src/users/users.module.ts
Additional comments not posted (12)
backend/src/auth/types/login-response.type.ts (1)
7-8: Properly documentedrefreshToken.The addition of the
refreshTokenproperty with the@ApiPropertyannotation is correctly implemented and aligns with the PR objectives to enhance token management capabilities.frontend/src/store/authSlice.ts (3)
8-8: Enhanced state management withrefreshToken.The addition of the
refreshTokenproperty in theAuthStateinterface and its initialization ininitialStateare well-implemented, enhancing the state management for authentication.Also applies to: 13-13
23-30: Well-implemented token management reducers.The new reducers
setRefreshTokenandlogoutare correctly implemented. Thelogoutfunction effectively resets both tokens and clears theAuthorizationheader, aligning with best practices for secure token management.
34-34: Correct export of slice actions.The export statement for
setAccessToken,setRefreshToken, andlogoutis correctly implemented, ensuring that these actions are available for use throughout the application.frontend/src/hooks/api/user.ts (2)
4-5: Updated imports and addedlogoutfunction.The adjustments to the import statements and the addition of the
logoutfunction fromauthSliceare correctly implemented, enhancing the functionality related to user authentication and state management.
34-34: Enhanced error handling inuseGetUserQuery.The modification to use the
logoutfunction in the error handling section ofuseGetUserQueryis a significant improvement. This change ensures that the user is logged out, clearing session data and enhancing security when a query fails.backend/src/auth/auth.service.ts (2)
11-15: Constructor updated to include essential services.The inclusion of
JwtServiceandConfigServicein the constructor is a positive change, enhancing the AuthService's capability to manage JWTs and configurations effectively.
17-40: Ensure secure handling of JWT secrets.The method
loginWithSocialProvidercorrectly uses different secrets for access and refresh tokens, addressing previous concerns about using the same JWT secret. It's recommended to perform a security audit to ensure that the secrets are stored and handled securely.frontend/src/components/popovers/ProfilePopover.tsx (1)
26-26: Updated logout functionality.The
handleLogoutfunction now dispatches thelogout()action, which likely encapsulates the logout process more comprehensively. Ensure that this new action is integrated correctly with the rest of the application.Verification successful
Logout action is correctly integrated.
The
logoutaction is defined and exported fromauthSliceand is imported in multiple files, includingProfilePopover.tsx,App.tsx, anduser.ts. This confirms its proper integration within the application.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the integration of the `logout()` action. # Test: Search for the usage of the `logout()` action in the application. Expect: Proper integration and handling. rg --type typescript 'dispatch\\(logout\\(\\)\\)'Length of output: 86
Script:
#!/bin/bash # Description: Verify the integration of the `logout()` action by searching for its usage in TypeScript files. # Find all TypeScript files and search for the usage of `dispatch(logout())`. fd --extension ts --exec rg 'dispatch\(logout\(\)\)' {}Length of output: 82
Script:
#!/bin/bash # Description: Search for the definition and imports of the `logout` action. # Search for the definition of `logout`. rg 'function logout' --type ts # Search for imports of `logout`. rg 'import.*logout' --type tsLength of output: 336
Script:
#!/bin/bash # Description: Search for the definition of the `logout` action within the `authSlice`. # Find the `authSlice` file and search for the `logout` action definition. fd 'authSlice' --extension ts --exec rg 'logout' {}Length of output: 152
backend/src/auth/auth.controller.ts (1)
25-26: Constructor streamlined with essential services.The inclusion of
AuthServiceandConfigServicein the constructor is a positive change, centralizing the authentication logic and reducing dependency complexity.frontend/src/App.tsx (2)
6-10: Approved new imports for enhanced functionality.The addition of Sentry, React Query, and Axios supports the new authentication handling and error tracking features.
Line range hint
64-138: Review of newuseEffectand Axios interceptor logic.The
useEffecthook adds an Axios response interceptor to handle 401 errors related to token expiration:
- The interceptor first checks if the error is from the
/auth/refreshendpoint to avoid retry loops.- If not, it sets a retry flag and attempts to refresh the token using the stored refresh token.
- If the refresh is successful, it updates the access token in both the Redux store and Axios headers and retries the failed request.
- If the refresh fails, it triggers a logout and clears user data.
Considerations:
- Ensure that the retry logic is robust and avoids potential infinite loops.
- Verify that all paths (success, failure, retry) are correctly handled and tested.
This implementation enhances the application's resilience against session expiration and automates token management, aligning with the PR's objectives.
Verification successful
Retry Logic in Axios Interceptor is Robust
The Axios interceptor logic in
frontend/src/App.tsxeffectively handles token expiration by using a_retryflag to prevent infinite loops and ensuring that all paths (success, failure, retry) are correctly managed. This implementation aligns with best practices for handling authentication token refresh scenarios.
- The
_retryflag prevents repeated refresh attempts for the same request.- The interceptor correctly handles both the refresh success and failure paths.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the robustness of the retry logic in the Axios interceptor. # Test: Search for potential infinite loops or unhandled paths in the interceptor logic. rg --type typescript -A 5 $'axios.interceptors.response.use'Length of output: 94
Script:
#!/bin/bash # Description: Verify the robustness of the retry logic in the Axios interceptor. # Test: Search for potential infinite loops or unhandled paths in the interceptor logic. rg --type ts -A 10 $'axios.interceptors.response.use'Length of output: 740
There was a problem hiding this comment.
Also, I recommend to create two JwtService objects like below code.
(Maybe, there are better approaches.)
auth.module.ts
@Module({
imports: [UsersModule],
providers: [
AuthService,
GithubStrategy,
JwtStrategy,
JwtRefreshStrategy,
{
provide: "JWT_ACCESS_SERVICE",
useFactory: (configService: ConfigService) => {
return new JwtService({
secret: configService.get<string>("JWT_ACCESS_TOKEN_SECRET"),
signOptions: {
expiresIn: `${configService.get("JWT_ACCESS_TOKEN_EXPIRATION_TIME")}s`,
},
});
},
inject: [ConfigService],
},
{
provide: "JWT_REFRESH_SERVICE",
useFactory: (configService: ConfigService) => {
return new JwtService({
secret: configService.get<string>("JWT_REFRESH_TOKEN_SECRET"),
signOptions: {
expiresIn: `${configService.get("JWT_REFRESH_TOKEN_EXPIRATION_TIME")}s`,
},
});
},
inject: [ConfigService],
},
],
exports: ["JWT_ACCESS_SERVICE", "JWT_REFRESH_SERVICE"],
controllers: [AuthController],
})
export class AuthModule {}auth.service.ts
constructor(
private readonly usersService: UsersService,
private readonly configService: ConfigService,
@Inject("JWT_ACCESS_SERVICE") private readonly jwtAccessService: JwtService,
@Inject("JWT_REFRESH_SERVICE") private readonly jwtRefreshService: JwtService
) {
// Check whether the tokens are intended value.
console.log("JWT_ACCESS_SERVICE", jwtAccessService);
console.log("JWT_REFRESH_SERVICE", jwtRefreshService);
}Also, you can create the object name constants :)
For example, @Inject(JwtInject.ACCESS).
If you have any questions, feel free to ask.
There was a problem hiding this comment.
Actionable comments posted: 0
Outside diff range, codebase verification and nitpick comments (1)
backend/src/auth/auth.service.ts (1)
29-38: LGTM, but consider adding error handling.The method
getNewAccessTokencorrectly verifies the refresh token and uses its payload to generate a new access token. Consider adding error handling for cases where the refresh token is invalid or expired to enhance security and user experience.
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (4)
- backend/.env.development (1 hunks)
- backend/src/auth/auth.module.ts (1 hunks)
- backend/src/auth/auth.service.ts (1 hunks)
- backend/src/utils/constants/jwt-inject.ts (1 hunks)
Files skipped from review due to trivial changes (1)
- backend/src/utils/constants/jwt-inject.ts
Additional comments not posted (8)
backend/src/auth/auth.service.ts (2)
11-15: LGTM!The changes to the constructor to inject separate
JwtServiceinstances for access and refresh tokens using theJwtInjectconstants are approved. This allows for better security and token management.
17-27: LGTM!The
loginWithSocialProvidermethod correctly handles social login by retrieving or creating the user and generating the necessary access and refresh tokens.backend/src/auth/auth.module.ts (3)
19-30: LGTM!The
JwtInject.ACCESSprovider correctly sets up a separateJwtServiceinstance for access tokens with its own secret and expiration settings retrieved from theConfigService. This allows for better control and security.
31-42: LGTM!The
JwtInject.REFRESHprovider correctly sets up a separateJwtServiceinstance for refresh tokens with its own secret and expiration settings retrieved from theConfigService. This allows for better control and security.
44-44: LGTM!Exporting the
JwtInject.ACCESSandJwtInject.REFRESHproviders in theexportsarray allows them to be used in other modules, which is necessary for theAuthServiceto function correctly.backend/.env.development (3)
23-24: LGTM!The refresh token secret and expiration time are correctly set. The expiration time of 1 week (604800 seconds) is reasonable for refresh tokens.
17-24: LGTM!The removal of the
JWT_AUTH_SECRETvariable is correct as it has been replaced with separate secrets for access and refresh tokens (JWT_ACCESS_TOKEN_SECRETandJWT_REFRESH_TOKEN_SECRET).
17-18: LGTM!The comments added for the
JWT_ACCESS_TOKEN_SECRET,JWT_ACCESS_TOKEN_EXPIRATION_TIME,JWT_REFRESH_TOKEN_SECRET, andJWT_REFRESH_TOKEN_EXPIRATION_TIMEvariables provide clear explanations of their purpose and usage. They serve as helpful documentation for developers.Also applies to: 21-22
There was a problem hiding this comment.
Actionable comments posted: 1
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (4)
- backend/.env.development (1 hunks)
- frontend/src/App.tsx (4 hunks)
- frontend/src/components/popovers/ProfilePopover.tsx (2 hunks)
- frontend/src/hooks/api/user.ts (2 hunks)
Files skipped from review as they are similar to previous changes (3)
- backend/.env.development
- frontend/src/components/popovers/ProfilePopover.tsx
- frontend/src/hooks/api/user.ts
Additional comments not posted (1)
frontend/src/App.tsx (1)
64-64: LGTM!The code changes are approved.
* Implement refresh token in backend * Implement token refresh with axios interceptor * Fix typo * Apply lint * Add Refresh token initialization * Update Axios interceptor to handle token expiration and refresh logic * Update environment variable comments for clarity * Separate dtos related to refresh token * Add `@ApiProperty` decorator * Update `@ApiBody` and `@ApiResponse` type * Separate JWT secrets for access and refresh tokens * Add logout logic and remove duplicate call * Update env variable comments for clarity * Split JwtService for access and refresh tokens * Fix interceptor logic for refresh token * Add error config token
What this PR does / why we need it?
This PR implements a Refresh Token mechanism alongside the existing Access Token authentication method. The addition of a Refresh Token enhances security and usability by allowing users to seamlessly obtain new Access Tokens without the need for reauthentication every time the Access Token expires.
The changes include:
Frontend:
/auth/refreshendpoint when the Access Token is detected as expired.POSTrequest to the/auth/refreshendpoint to retrieve a new Access Token.Backend:
RefreshStrategyto manage Refresh Token validity and secure handling.POST /auth/refreshAPI to generate a new Access Token using a valid Refresh Token.Currently, the Access Token has a validity of one day, while the Refresh Token is valid for one week.
Any background context you want to provide?
The introduction of a Refresh Token aligns with best practices in API authentication and allows for more robust user sessions while minimizing the friction caused by token expiration. Careful consideration has been given to token lifecycle management and the implications for existing client applications and authentication flows.
What are the relevant tickets?
Fixes #160
Checklist
Summary by CodeRabbit
New Features
Bug Fixes
Style
Chores