dylan/vod-system
1
1
Fork 0
Code Issues 16 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat(security): add refresh token capability to API #52

Merged
dylan merged 1 commits from feat/add-refresh-tokens-backend into master 2026-10-16 20:56:02 +01:00
Conversation 0 Commits 1 Files Changed 20 +741 -117
dylan commented 2026-10-16 20:47:58 +01:00
Owner
Copy Link

Add backend refresh tokens

Adds rotating server-side refresh tokens so the access token can be short-lived (5m) without forcing frequent re-login.

  • New POST /api/v1/users/refresh exchanges the refreshToken cookie for a new refresh token and JWT
  • Each login starts a token family; reusing a used token after the 5s grace period revokes the whole family
  • Logout revokes the family; an hourly job deletes dead families
  • Google ID token verification extracted into GoogleVerifierService; config moved to a validated AuthProperties
  • Unauthenticated requests now return 401 instead of 403
  • Migration V2__refresh_tokens.sql adds token_families and refresh_tokens

Breaking changes

  • Cookie token renamed to accessToken (existing sessions are logged out)
  • /login and /refresh no longer return the JWT in the body, only { accessTokenExpiresIn }
  • jwt.secret.key / jwt.expiration replaced by app.security.*; JWT_SECRET_KEY must be 32+ chars
  • Frontend must call /refresh on 401 or before the access token expires
## Add backend refresh tokens Adds rotating server-side refresh tokens so the access token can be short-lived (5m) without forcing frequent re-login. - New `POST /api/v1/users/refresh` exchanges the `refreshToken` cookie for a new refresh token and JWT - Each login starts a token family; reusing a used token after the 5s grace period revokes the whole family - Logout revokes the family; an hourly job deletes dead families - Google ID token verification extracted into `GoogleVerifierService`; config moved to a validated `AuthProperties` - Unauthenticated requests now return 401 instead of 403 - Migration `V2__refresh_tokens.sql` adds `token_families` and `refresh_tokens` **Breaking changes** - Cookie `token` renamed to `accessToken` (existing sessions are logged out) - `/login` and `/refresh` no longer return the JWT in the body, only `{ accessTokenExpiresIn }` - `jwt.secret.key` / `jwt.expiration` replaced by `app.security.*`; `JWT_SECRET_KEY` must be 32+ chars - Frontend must call `/refresh` on 401 or before the access token expires
dylan added 1 commit 2026-10-16 20:47:58 +01:00
add backend tokens
All checks were successful
CI / Maven unit tests (push) Successful in 15s
Details
CI / Build and push images (push) Has been skipped
Details
CI / Deploy to server (push) Has been skipped
Details
12852e034d
dylan changed title from WIP: feat(security): add refresh token capability to API to feat(security): add refresh token capability to API 2026-10-16 20:55:56 +01:00
dylan merged commit 222b0b60f7 into master 2026-10-16 20:56:02 +01:00
dylan deleted branch feat/add-refresh-tokens-backend 2026-10-16 20:56:02 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
epic
high-priority
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dylan
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dylan/vod-system#52
Delete Branch "feat/add-refresh-tokens-backend"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?