dylan/vod-system
1
1
Fork 0
Code Issues 16 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

WIP: feat(security): implement refresh tokens #49

Closed
dylan wants to merge 25 commits from feat/add-refresh-tokens into master
pull from: feat/add-refresh-tokens
merge into: dylan:master
Conversation 1 Commits 25 Files Changed 26 +8 -9
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 8166c62bb1 - Show all commits

11
src/main/java/com/ddf/vodsystem/security/TokenService.java
View File

@@ -89,12 +89,9 @@ public class TokenService {
}
// Reuse Check
if (refreshToken.getUsedAt() != null) {
if (now.isAfter(refreshToken.getUsedAt().plus(refreshGracePeriod))) {
tokenFamily.setRevokedAt(Instant.now());
if (refreshToken.getUsedAt() != null && now.isAfter(refreshToken.getUsedAt().plus(refreshGracePeriod))) {
tokenFamily.setRevokedAt(now);
tokenFamilyRepository.save(tokenFamily);
}
throw new NotAuthenticated("Refresh token already being used");
}
@@ -106,9 +103,11 @@ public class TokenService {
throw new NotAuthenticated("Refresh token or family expired");
}
// Rotate
// Invalidate old token, unless we're within the grace period, otherwise the grace gets extended
if (refreshToken.getUsedAt() == null) {
refreshToken.setUsedAt(now);
refreshTokenRepository.save(refreshToken);
}
byte[] newRawToken = generateRandomBytes(32);
createRefreshToken(