docs(techniques/authentication): add refresh-token implementation steps #1468
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Keithcat767
reviewed
Nov 24, 2020
|
|
||
| When the JWT strategy is in play, the token will expire within a short time frame and the user will have to re-enter authentication details to generate a new JWT. Instead, the user can be sent a refresh-token together with a JWT at the time of authentication. This refresh-token would preferably have a different secret and a longer expiration time. | ||
|
|
||
| Since the refresh-token is generated at the same time as the JWT follwing a similar mechanism, it's convenint to keep this within the AuthModule. |
There was a problem hiding this comment.
Small typo, convenint should be convenient
|
|
||
| When the JWT strategy is in play, the token will expire within a short time frame and the user will have to re-enter authentication details to generate a new JWT. Instead, the user can be sent a refresh-token together with a JWT at the time of authentication. This refresh-token would preferably have a different secret and a longer expiration time. | ||
|
|
||
| Since the refresh-token is generated at the same time as the JWT follwing a similar mechanism, it's convenint to keep this within the AuthModule. |
There was a problem hiding this comment.
Suggested change
| Since the refresh-token is generated at the same time as the JWT follwing a similar mechanism, it's convenint to keep this within the AuthModule. | |
| Since the refresh-token is generated at the same time as the JWT following a similar mechanism, it's convenient to keep this within the `AuthModule`. |
adamwdennis
reviewed
Mar 22, 2022
| @@ -921,6 +921,159 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'myjwt') | |||
|
|
|||
| Then, you refer to this via a decorator like `@UseGuards(AuthGuard('myjwt'))`. | |||
|
|
|||
| #### Refresh-Token Functionality | |||
|
|
|||
| When the JWT strategy is in play, the token will expire within a short time frame and the user will have to re-enter authentication details to generate a new JWT. Instead, the user can be sent a refresh-token together with a JWT at the time of authentication. This refresh-token would preferably have a different secret and a longer expiration time. | |||
|
Thanks for this.. It took me a full day to find this answer to my problem with access/refresh tokens... i started by adding a custom claim 'token_type', but this makes SO much more sense (signing refresh tokens with different secrets). Thank you. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
nestjs/jwt#122
Issue Number:
What is the new behavior?
Add documentation for refresh-token mechanism.
Does this PR introduce a breaking change?
Other information
This NodeJS refresh-token implementation was used as reference to come up with the following refresh-token mechanism for NestJS.