wip/authorization-header

radical commented

2025-05-04 17:13:37 +00:00

Owner

Uses authorization headers instead of keeping access_token and refresh_token in body.
Needs testing, just ask if something is unclear here

auth header is used for access_token

Changes

Moved everything to /api

POST -> GET /v1/users/me

Request: auth header

POST -> GET /v1/users/{uuid}

Request: auth header

POST -> GET /v1/users

Request: auth header and query params start=int and amount=int

POST /v1/auth/register

Response: Remove refresh_token from body and instead set-cookie refresh_token

POST /v1/auth/refresh

Request: cookie refresh_token
Response: Remove refresh_token from body and instead set-cookie refresh_token

POST /v1/auth/revoke

Request: auth header (password still in body)

Uses authorization headers instead of keeping access_token and refresh_token in body. Needs testing, just ask if something is unclear here auth header is used for `access_token` ## Changes Moved everything to /api ### POST -> GET /v1/users/me Request: auth header ### POST -> GET /v1/users/{uuid} Request: auth header ### POST -> GET /v1/users Request: auth header and query params `start=int` and `amount=int` ### POST /v1/auth/register Response: Remove `refresh_token` from body and instead set-cookie `refresh_token` ### POST /v1/auth/login Response: Remove `refresh_token` from body and instead set-cookie `refresh_token` ### POST /v1/auth/refresh Request: cookie `refresh_token` Response: Remove `refresh_token` from body and instead set-cookie `refresh_token` ### POST /v1/auth/revoke Request: auth header (password still in body)

radical added 3 commits 2025-05-04 17:13:38 +00:00

feat: add utils.rs aa865e2ed4

provides a function that extracts auth header from headers

style: use created_at instead of created 6c706d973e

feat: switch to headers for auth cbf0131d14

radical self-assigned this 2025-05-04 17:14:23 +00:00

requested review from sauceyred

2025-05-04 17:14:35 +00:00

radical changed title from ~~wip/authorization-header~~ to WIP: wip/authorization-header

2025-05-04 17:14:36 +00:00

radical started working 2025-05-04 17:28:32 +00:00

radical canceled time tracking 2025-05-04 17:28:44 +00:00

radical added 1 commit 2025-05-04 18:30:33 +00:00

fix: use correct header a3846a2620

radical added 1 commit 2025-05-04 19:30:38 +00:00

fix: extract auth value f12f81d584

radical added 2 commits 2025-05-04 20:13:34 +00:00

refactor: move api to /api ebb4286c08

serve api under /api

feat: return refresh_token in cookie 0f897dc0c6

sauceyred commented

2025-05-04 20:37:36 +00:00

Owner

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

radical commented

2025-05-04 20:38:54 +00:00

Author

Owner

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

@sauceyred wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-62: > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

sauceyred commented

2025-05-04 20:41:43 +00:00

Owner

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-63: > @sauceyred wrote in #7 (comment): > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

radical commented

2025-05-04 20:46:31 +00:00

Author

Owner

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

@sauceyred wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-64: > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

radical commented

2025-05-04 20:48:55 +00:00

Author

Owner

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

sauceyred commented

2025-05-04 20:51:01 +00:00

Owner

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session.

@radical wrote in #7 (comment):

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-65: > @sauceyred wrote in #7 (comment): > > > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > > > > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? > > revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session. @radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-66: > also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401? Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

radical commented

2025-05-04 20:52:44 +00:00

Author

Owner

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session.

@radical wrote in #7 (comment):

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid

@sauceyred wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-67: > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > @radical wrote in #7 (comment): > > > > @sauceyred wrote in #7 (comment): > > > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > > > > > > > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? > > > > > > revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao > > Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session. > > @radical wrote in #7 (comment): > > > also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401? > > Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required. Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid

sauceyred commented

2025-05-04 20:57:20 +00:00

Owner

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session.
@radical wrote in #7 (comment):

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid

This is the way to remove the cookie. That's why 401 on refresh 200 on logout should send back a Set-Cookie header to remove it.

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-68: > @sauceyred wrote in #7 (comment): > > > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > > @radical wrote in #7 (comment): > > > > > @sauceyred wrote in #7 (comment): > > > > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > > > > > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > > > > > > > > > > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? > > > > > > > > > revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao > > > > > > Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session. > > @radical wrote in #7 (comment): > > > also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401? > > > > > > Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required. > > Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid This *is* the way to remove the cookie. That's why 401 on refresh 200 on logout should send back a Set-Cookie header to remove it.

radical commented

2025-05-04 20:57:47 +00:00

Author

Owner

apparently actix has a built in for this, ill implement it

let mut refresh_token_cookie = refresh_token_cookie(refresh_token);

refresh_token_cookie.make_removal();

return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish());

https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal

apparently actix has a built in for this, ill implement it ```rs let mut refresh_token_cookie = refresh_token_cookie(refresh_token); refresh_token_cookie.make_removal(); return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish()); ``` https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal

sauceyred commented

2025-05-04 20:58:29 +00:00

Owner

@radical wrote in #7 (comment):

apparently actix has a built in for this, ill implement it
let mut refresh_token_cookie = refresh_token_cookie(refresh_token);

refresh_token_cookie.make_removal();

return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish());
https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal

Hell yeah

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-70: > apparently actix has a built in for this, ill implement it > > ```rs > let mut refresh_token_cookie = refresh_token_cookie(refresh_token); > > refresh_token_cookie.make_removal(); > > return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish()); > ``` > > https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal Hell yeah

radical commented

2025-05-04 20:59:08 +00:00

Author

Owner

revoke will not be changed however, we'll have a separate endpoint for logout

sauceyred commented

2025-05-04 20:59:36 +00:00

Owner

@radical wrote in #7 (comment):

revoke will not be changed however, we'll have a separate endpoint for logout

Agreed

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-72: > revoke will not be changed however, we'll have a separate endpoint for logout Agreed

radical added 1 commit 2025-05-04 21:02:24 +00:00

feat: expire refresh_token immediately on unauthorized response c61f96ffe7