Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

docs(techniques/authentication): add refresh-token implementation steps #1468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dinuka-rp wants to merge 2 commits into nestjs:master
base: master
Choose a base branch
Loading
from dinuka-rp:master

Conversation

Copy link

@dinuka-rp dinuka-rp commented Sep 22, 2020

PR Checklist

Please check if your PR fulfills the following requirements:

PR Type

What kind of change does this PR introduce?

[ ] Bugfix
[x] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Build related changes
[ ] Other... Please describe:

What is the current behavior?

nestjs/jwt#122

Issue Number:

What is the new behavior?

Add documentation for refresh-token mechanism.

Does this PR introduce a breaking change?

[ ] Yes
[x] No

Other information

This NodeJS refresh-token implementation was used as reference to come up with the following refresh-token mechanism for NestJS.

lohanidamodar, alexedtionweb, zxzl, khorark, notmd, and iangabrielsanchez reacted with thumbs up emoji

When the JWT strategy is in play, the token will expire within a short time frame and the user will have to re-enter authentication details to generate a new JWT. Instead, the user can be sent a refresh-token together with a JWT at the time of authentication. This refresh-token would preferably have a different secret and a longer expiration time.

Since the refresh-token is generated at the same time as the JWT follwing a similar mechanism, it's convenint to keep this within the AuthModule.
Copy link

@Keithcat767 Keithcat767 Nov 24, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small typo, convenint should be convenient


When the JWT strategy is in play, the token will expire within a short time frame and the user will have to re-enter authentication details to generate a new JWT. Instead, the user can be sent a refresh-token together with a JWT at the time of authentication. This refresh-token would preferably have a different secret and a longer expiration time.

Since the refresh-token is generated at the same time as the JWT follwing a similar mechanism, it's convenint to keep this within the AuthModule.
Copy link
Contributor

@johannesschobel johannesschobel Dec 8, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Since the refresh-token is generated at the same time as the JWT follwing a similar mechanism, it's convenint to keep this within the AuthModule.
Since the refresh-token is generated at the same time as the JWT following a similar mechanism, it's convenient to keep this within the `AuthModule`.

@@ -921,6 +921,159 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'myjwt')

Then, you refer to this via a decorator like `@UseGuards(AuthGuard('myjwt'))`.

#### Refresh-Token Functionality

When the JWT strategy is in play, the token will expire within a short time frame and the user will have to re-enter authentication details to generate a new JWT. Instead, the user can be sent a refresh-token together with a JWT at the time of authentication. This refresh-token would preferably have a different secret and a longer expiration time.
Copy link

@adamwdennis adamwdennis Mar 22, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Copy link

Thanks for this.. It took me a full day to find this answer to my problem with access/refresh tokens... i started by adding a custom claim 'token_type', but this makes SO much more sense (signing refresh tokens with different secrets). Thank you.
dinuka-rp reacted with thumbs up emoji

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@johnbiundo johnbiundo Awaiting requested review from johnbiundo

3 more reviewers

@adamwdennis adamwdennis adamwdennis left review comments

@johannesschobel johannesschobel johannesschobel left review comments

@Keithcat767 Keithcat767 Keithcat767 left review comments

Reviewers whose approvals may not affect merge requirements
Assignees
No one assigned
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /