If the user is logged out, someone else can take the token and use it to fetch the details about user.

[ladrahul00]

You have deleted user token from redis store but the token is still valid(authorized=true), it is not invalidated. In middleware you are only checking if the token is authorized or not.

[Massad]

@wolf00 yes, to check if the token is valid or not as an example. However, in the "controllers" where user needs to be verified you can use getUserID() to validate it.

Example: https://github.com/Massad/gin-boilerplate/blob/master/controllers/article.go#L21

Which eventually calls FetchAuth that verifies both the token and existence in redis:

https://github.com/Massad/gin-boilerplate/blob/74273606cd727adb12688ed4f12f3385ecb6f17a/models/auth.go#L158

You can move this layer to the middleware if you want.

Let me know if that clarifies your concern.

[Massad]

On second thought, I've modified it to validate both the token and Redis at the same time in the middleware itself and then it will pass the userID from Redis using c.MustGet("userID").(int64) in getUserID()

Take a look at this commit: https://github.com/Massad/gin-boilerplate/commit/6fd4f8070fa3d87f0706bd97f3ce5d7907fea09d and let me know your thoughts.

Thanks for pointing it out.

[ladrahul00]

Thanks @Massad looks good now.