fix(security): restrict refresh token scope #103

New issue

Open

opened 2025-11-04 11:24:14 +00:00 by chartgerink · 1 comment

chartgerink commented

2025-11-04 11:24:14 +00:00

Owner

Set-Cookie: refreshToken=...; HttpOnly; Secure; SameSite=Strict; Path=/api/auth/refresh; Max-Age=604800

This helps secure the refresh token to only be transmitted when the appropriate endpoint is used. See also

https://junkangworld.com/blog/the-definitive-guide-to-refreshing-httponly-tokens#implementation-flow

> `Set-Cookie: refreshToken=...; HttpOnly; Secure; SameSite=Strict; Path=/api/auth/refresh; Max-Age=604800` This helps secure the refresh token to only be transmitted when the appropriate endpoint is used. See also https://junkangworld.com/blog/the-definitive-guide-to-refreshing-httponly-tokens#implementation-flow

chartgerink added this to the v2.0.0 milestone

2025-11-04 11:24:14 +00:00

chartgerink commented

2025-11-05 14:26:29 +00:00

Author

Owner

Will have to handle the middleware as it currently uses the presence/absence of refresh token in the logic.

access	refresh	result
x	_	200 (if valid)
_	x	401
_	_	_

It is important that the refresh process stays functional.

Will have to handle the middleware as it currently uses the presence/absence of refresh token in the logic. | access | refresh | result | | -- | -- | -- | | x | _ | 200 (if valid) | | _ | x | 401 | | _ | _ | _ | It is important that the refresh process stays functional.