nuxt-community / auth-module

Zero-boilerplate authentication support for Nuxt 2
https://auth.nuxtjs.org
MIT License
1.93k stars 924 forks source link

Rolling Session Cookie httpOnly #1662

Open Vipale opened 2 years ago

Vipale commented 2 years ago

I set up express.js with passport.js and a rolling cookie session with httpOnly. Using "@nuxtjs/auth-next": "5.0.0-1624817847.21691f1",

  1. attempt Because of httpOnly cookie expiration cannot be accessed so I set it manually. This works, but it leads to the problem that rolling session isn't used and I get logged out after cookie expiration.

  2. attempt I tried to set token maxAge to false. As long as I did a request before cookie expiration I am fine, the cookie is updated and I can keep going. But once I won't do a request in time session runs out (as expected), but nuxt auth does not know an I won't be redirected to the login page.

How do I set up nuxt auth with a rolling cookie session?

Cookies after login; grafik

nuxt.config.js:

  auth: {
    localStorage: {
      prefix: 'auth.'
    },
    cookie: {
      prefix: 'auth.',
      options: {
        sameSite: 'lax',
      }
    },
    redirect: {
      login: "/user/login",
      logout: "/user/login",
      home: "/"
    },
    strategies: {
      local: {
        token: {
          maxAge: false,
          required: false,
          type: false          
        },   
        endpoints: {
          login: { 
            url: 'auth/login', 
            method: 'post',
            withCredentials: true,          
          },
          logout: { 
            url: 'auth/logout', 
            method: 'post',           
          },
          user: { 
            url: 'auth/user', 
            method: 'get',         
          },
        }, 
      }
    }
  },

One way I could think of to do that would be to set maxage and having the option to reset auth._token._expiration.local on each request.

Vipale commented 2 years ago

No response after nearly 2 months. Is it just not possible or did I miss something?