feat(auth): add refresh token rotation security

Refresh tokens are generated for the user at all times. Refresh tokens are rotated everytime a refresh token is used. If a refresh token is used twice, it is marked as compromised and the user is locked out.
tenseijs · Nov 26, 2020 · edf90e4 · edf90e4
1 parent 72e8b42
commit edf90e4
Show file tree

Hide file tree

Showing 9 changed files with 248 additions and 18,301 deletions.
diff --git a/examples/blog/app.js b/examples/blog/app.js
@@ -39,10 +39,6 @@ module.exports = tensei()
             .teams()
             .apiPath('auth')
             .rolesAndPermissions()
-            .jwt({
-                expiresIn: 60,
-                refreshTokenExpiresIn: 60 * 2,
-            })
             .social('github', {
                 key: process.env.GITHUB_KEY,
                 secret: process.env.GITHUB_SECRET,

diff --git a/packages/auth/src/config.ts b/packages/auth/src/config.ts
@@ -33,19 +33,27 @@ export type AuthResources = {
     permission: ResourceContract
     teamInvite: ResourceContract
     passwordReset: ResourceContract
+    token: ResourceContract
 }
+
+export enum TokenTypes {
+    REFRESH = 'REFRESH',
+    API = 'API'
+}
+
 export interface AuthPluginConfig {
     fields: FieldContract[]
     profilePictures: boolean
     userResource: string
     roleResource: string
+    disableCookies: boolean
     permissionResource: string
     rolesAndPermissions: boolean
     passwordResetResource: string
     apiPath: string
-    jwt: {
-        expiresIn: number
+    tokensConfig: {
         secretKey: string
+        accessTokenExpiresIn: number
         refreshTokenExpiresIn: number
     }
     refreshTokenCookieName: string