nuxt-community / auth-module

Zero-boilerplate authentication support for Nuxt 2
https://auth.nuxtjs.org
MIT License
1.93k stars 924 forks source link

How to use refresh tokens #1824

Closed s-oosato closed 1 year ago

s-oosato commented 1 year ago

I'm sorry if there are any mistakes because my native language is not English. I'm using this module with the configuration below, but when I run auth/rerfresh it's requesting using the access_token. I get the Authorization header on the server side, and when I decode the JWT, the content is access_token. I am assuming that with this module, when the access_token expires, it will set the refresh_token in the Authorization header and run api/auth/refresh.

Please let me know if there are any mistakes

[nuxt.config.js]
   auth: {
    redirect: {
      login:    '/login', 
      logout:   '/login',
      callback: '/login', 
      home:     '/'      
    },
    strategies: {
      local: {
        scheme:     'refresh',
        autoLogout: true,
        token: {
          property: 'access_token',
          maxAge:   1800,
          global:   true,
          // type: 'Bearer'
        },
        refreshToken: {
          property: 'refresh_token',
          data:     'refresh_token',
          maxAge:   60 * 60 * 24 * 30
        },
        user: {
          property:   false,
          autoFetch:  true
        },
        endpoints: {
          login: {
            url:          '/auth/login',
            method:       'post',
            propertyName: 'access_token',
            headers: {
              "Content-Type": "application/x-www-form-urlencoded",
              "grant_type":   "password"
            },
          },
          refresh:  { url: '/auth/refresh', method: 'get'                       },
          logout:   { url: '/auth/logout',  method: 'post',                     },
          user:     { url: '/auth/me',      method: 'get', propertyName: false  }
        }
      },

image image

s-oosato commented 1 year ago

refresh: { url: '/auth/refresh', method: 'post' },

Changed as above.

I expected refresh_token to be included in the Authorization header, but it seems to be included in the request body. Changed to refer to the request body in server-side processing.