Repository navigation
Release/1.0 - #79
Open
MaximeMRF wants to merge 10 commits into
Open
Release/1.0#79MaximeMRF wants to merge 10 commits into
MaximeMRF wants to merge 10 commits into
Conversation
Security: - derive the signing key from the app key (HKDF-SHA256, salted with the guard name) and require an app key of at least 32 characters - access tokens expire after 1h by default (DEFAULT_TOKEN_EXPIRES_IN) - JWKS: issuer and audience are required, safe jwks-rsa defaults (cache, rate limit, 10 requests/min, 5s timeout) - revoke() clears the access and refresh token cookies - refresh tokens are never read from the query string - generateWithRefreshToken rejects refresh tokens missing the configured refreshTokenAbilities - generateWithRefreshToken only authenticates the user once the refresh token has been deleted (a concurrent refresh can no longer leave the guard authenticated) Token transport: - the refresh token body field follows refreshTokenName - refresh token lookup order: cookie, body, Authorization header - access token lookup order: Authorization header, then the cookie, which is only read when useCookies is enabled Public API: - JwtGuardOptions.expiresIn is renamed to tokenExpiresIn - jwtGuard() content is typed after the provider's user - the main entrypoint exports jwtGuard, JwtGuard and DEFAULT_TOKEN_EXPIRES_IN (./jwt_config is kept) - user.currentToken holds the new access token after a refresh, and generateWithRefreshToken no longer returns undefined - @adonisjs/auth is a peer dependency, @types/node ^24 Tests: signed cookies in cookie tests, refresh token replay, concurrency and expiration, Set-Cookie attributes, forged tokens (alg none, HS256 with the public key, tampered payload and signature), clockTolerance. BREAKING CHANGE: access tokens issued by 0.9 are rejected (refresh tokens stay valid), app key must be at least 32 characters, tokens expire after 1h by default and a content function setting exp fails, JWKS requires issuer and audience, the refresh token body field follows refreshTokenName, the token cookie is only read when useCookies is enabled, JwtGuardOptions.expiresIn is renamed to tokenExpiresIn.
New AdonisJS v7 apps don't define appKey in config/app.ts: APP_KEY is only passed to config/encryption.ts. Without a secret, the guard failed to start. It now reads app.appKey when it exists, and falls back on the APP_KEY environment variable. The derived signing key is the same in both cases.
…tion node ace configure now: - adds a jwt guard to config/auth.ts (the default guard is unchanged) - with refresh tokens, adds the refreshTokens provider to the User model and creates the jwt_refresh_tokens migration - prints the next steps --refresh-tokens / --no-refresh-tokens skip the question. Inserted code follows the indentation, trailing commas and semicolons of the user's files, nothing is duplicated when the hook runs again, and the code to add is printed when a file doesn't have the expected shape.
…udience in JWKS mode
…, end the generated migration with a newline
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.