fix(auth): upgrade cookie flows to upgrade access tokens, refresh tokens #92

New issue

Closed

opened 2025-10-14 14:40:45 +00:00 by chartgerink · 1 comment

chartgerink commented

2025-10-14 14:40:45 +00:00

Owner

Currently, the upgrade to using solely HttpOnly cookies for auth has left elements kaputt. Primarily, the refresh flow no longer works as expected, which needs to be fixed in the middleware.

In short:

We want requests with valid access tokens to be handled, and the access token automatically refreshed if almost expired (TBD what "almost" means)
Requests with expired access tokens but valid refresh tokens are honored, and refresh the access token
Requests with expired access and refresh tokens are automatically cleared, equivalent to being logged out.

This issue tracks the work to upgrade this.

Logout - ensure credentials are included

Currently, the upgrade to using solely HttpOnly cookies for auth has left elements kaputt. Primarily, the refresh flow no longer works as expected, which needs to be fixed in the middleware. In short: 1. We want requests with valid access tokens to be handled, and the access token automatically refreshed if almost expired (TBD what "almost" means) 2. Requests with expired access tokens but valid refresh tokens are honored, and refresh the access token 3. Requests with expired access and refresh tokens are automatically cleared, equivalent to being logged out. This issue tracks the work to upgrade this. - [x] Logout - ensure credentials are included

chartgerink commented

2025-10-16 12:49:01 +00:00

Author

Owner

I tried managing all of this from within the middleware, but it was getting very messy.

My alternative approach is as follows:

Middleware checks for access token
If expired, 307 (tmp) redirect to /auth/refresh?redirect_uri=.... to refresh the access token
Upon refresh it provides another redirect back to the original request, which is now with a fresh access token

This isolates the refresh process and allows optimization (see also researchequals/frontend#12) to be done there.

Tasks:

Implement refresh endpoint
Implement redirect from middleware when access token is expired
Implement redirect from refresh endpoint to redirect uri (if present)

I tried managing all of this from within the middleware, but it was getting very messy. My alternative approach is as follows: 1. Middleware checks for access token 2. If expired, 307 (tmp) redirect to `/auth/refresh?redirect_uri=....` to refresh the access token 3. Upon refresh it provides another redirect back to the original request, which is now with a fresh access token This isolates the refresh process and allows optimization (see also https://git.libscie.org/researchequals/frontend/issues/12) to be done there. Tasks: - [ ] Implement refresh endpoint - [ ] Implement redirect from middleware when access token is expired - [ ] Implement redirect from refresh endpoint to redirect uri (if present)