CU-djy95a - Make jwt more secure using refresh token and algorithm

[varshakamath1]

1. During login, accessToken and refreshToken both are generated.

POST: http://localhost:3001/login

Request body: { "username": "PID5", "password":"PID5", "newPassword":"", "role": "patient" }

Response { "accessToken": "XXX", "refreshToken": "YYY" }

accessToken expires in 5 minutes. Any request made using the accessToken after 5 minutes returns the response as FORBIDDEN.

2. Then a post request must be done with the refreshToken and the role. The response is new access token.

POST: http://localhost:3001/token

Request body:

{ "role": "patient", "token" : "YYY" //refreshToken }

Response { "accessToken": "ZZZ" // new accessToken }

3. Logout - It is to make sure that when the user is logged out, no one will be able to use the refresh token to generate a new authentication token.

DELETE: http://localhost:3001/logout

Request body: { "token" : "YYY" //refreshToken }

Response: 204 status

[kshitijyelpale]

Task linked: CU-djy95a Make jwt more secure using refresh token and algorithm