wip/authorization-header #7

Merged

radical merged 8 commits from wip/authorization-header into main 2025-05-04 21:18:28 +00:00

Conversation 13 Commits 8 Files changed 11 +176 -200

radical commented 2025-05-04 17:13:37 +00:00

Owner

Copy link

Uses authorization headers instead of keeping access_token and refresh_token in body.
Needs testing, just ask if something is unclear here

auth header is used for access_token

Changes

Moved everything to /api

POST -> GET /v1/users/me

Request: auth header

POST -> GET /v1/users/{uuid}

Request: auth header

POST -> GET /v1/users

Request: auth header and query params start=int and amount=int

POST /v1/auth/register

Response: Remove refresh_token from body and instead set-cookie refresh_token

POST /v1/auth/login

Response: Remove refresh_token from body and instead set-cookie refresh_token

POST /v1/auth/refresh

Request: cookie refresh_token
Response: Remove refresh_token from body and instead set-cookie refresh_token

POST /v1/auth/revoke

Request: auth header (password still in body)

Uses authorization headers instead of keeping access_token and refresh_token in body. Needs testing, just ask if something is unclear here auth header is used for `access_token` ## Changes Moved everything to /api ### POST -> GET /v1/users/me Request: auth header ### POST -> GET /v1/users/{uuid} Request: auth header ### POST -> GET /v1/users Request: auth header and query params `start=int` and `amount=int` ### POST /v1/auth/register Response: Remove `refresh_token` from body and instead set-cookie `refresh_token` ### POST /v1/auth/login Response: Remove `refresh_token` from body and instead set-cookie `refresh_token` ### POST /v1/auth/refresh Request: cookie `refresh_token` Response: Remove `refresh_token` from body and instead set-cookie `refresh_token` ### POST /v1/auth/revoke Request: auth header (password still in body)

radical added 3 commits 2025-05-04 17:13:38 +00:00

feat: add utils.rs ... aa865e2ed4

provides a function that extracts auth header from headers

style: use created_at instead of created 6c706d973e

feat: switch to headers for auth cbf0131d14

radical self-assigned this 2025-05-04 17:14:23 +00:00

requested review from sauceyred 2025-05-04 17:14:35 +00:00

radical changed title from wip/authorization-header to WIP: wip/authorization-header 2025-05-04 17:14:36 +00:00

radical started working 2025-05-04 17:28:32 +00:00

radical canceled time tracking 2025-05-04 17:28:44 +00:00

radical added 1 commit 2025-05-04 18:30:33 +00:00

fix: use correct header a3846a2620

radical added 1 commit 2025-05-04 19:30:38 +00:00

fix: extract auth value f12f81d584

radical added 2 commits 2025-05-04 20:13:34 +00:00

refactor: move api to /api ... ebb4286c08

serve api under /api

feat: return refresh_token in cookie 0f897dc0c6

sauceyred commented 2025-05-04 20:37:36 +00:00

Owner

Copy link

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

radical commented 2025-05-04 20:38:54 +00:00

Author

Owner

Copy link

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

@sauceyred wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-62: > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

sauceyred commented 2025-05-04 20:41:43 +00:00

Owner

Copy link

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-63: > @sauceyred wrote in #7 (comment): > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

radical commented 2025-05-04 20:46:31 +00:00

Author

Owner

Copy link

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

@sauceyred wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-64: > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

radical commented 2025-05-04 20:48:55 +00:00

Author

Owner

Copy link

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

sauceyred commented 2025-05-04 20:51:01 +00:00

Owner

Copy link

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session.

@radical wrote in #7 (comment):

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-65: > @sauceyred wrote in #7 (comment): > > > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > > > > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? > > revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session. @radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-66: > also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401? Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

radical commented 2025-05-04 20:52:44 +00:00

Author

Owner

Copy link

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session.

@radical wrote in #7 (comment):

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid

@sauceyred wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-67: > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > @radical wrote in #7 (comment): > > > > @sauceyred wrote in #7 (comment): > > > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > > > > > > > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? > > > > > > revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao > > Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session. > > @radical wrote in #7 (comment): > > > also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401? > > Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required. Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid

sauceyred commented 2025-05-04 20:57:20 +00:00

Owner

Copy link

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

@radical wrote in #7 (comment):

@sauceyred wrote in #7 (comment):

Please add Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0 to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie.

adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie?

When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no?

revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao

Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session.
@radical wrote in #7 (comment):

also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401?

Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required.

Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid

This is the way to remove the cookie. That's why 401 on refresh 200 on logout should send back a Set-Cookie header to remove it.

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-68: > @sauceyred wrote in #7 (comment): > > > @radical wrote in #7 (comment): > > > @sauceyred wrote in #7 (comment): > > > > @radical wrote in #7 (comment): > > > > > @sauceyred wrote in #7 (comment): > > > > > > Please add `Set-Cookie: refresh_token={token}; HttpOnly; Secure; SameSite=None; Path=/api/; Max-Age=0` to the 401 response of the /refresh endpoint and the 200 response of the /revoke endpoint so the browser deletes the cookie. > > > > > > > > > > > > > > > adding it to the 200 of the revoke response doesnt make sense unless you're revoking your own cookie? > > > > > > > > > > > > When you log out (call the /revoke endpoint), the access and refresh tokens are invalidated, so the refresh token cookie should be deleted to reflect that, no? > > > > > > > > > revoke isnt a logout endpoint, its to logout other clients logged into your account, we dont have any way to log yourself out yet lmao > > > > > > Fair enough, I've just been using the revoke as a logout endpoint for testing and found it to be working fine, but yeah it doesn't make as much sense for logging out of your local session. > > @radical wrote in #7 (comment): > > > also why does the backend need to set it to 0, shouldnt the frontend just remove the token if it gets a 401? > > > > > > Because the client can't touch the refresh token cookie since it has the HttpOnly flag, meaning it can't be accessed through JavaScript, a response with a Set-Cookie header is required. > > Isnt there a way to remove the cookie? It seems very crude to set it in this way instead of removing it outright when its invalid This *is* the way to remove the cookie. That's why 401 on refresh 200 on logout should send back a Set-Cookie header to remove it.

radical commented 2025-05-04 20:57:47 +00:00

Author

Owner

Copy link

apparently actix has a built in for this, ill implement it

let mut refresh_token_cookie = refresh_token_cookie(refresh_token);

refresh_token_cookie.make_removal();

return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish());

https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal

apparently actix has a built in for this, ill implement it ```rs let mut refresh_token_cookie = refresh_token_cookie(refresh_token); refresh_token_cookie.make_removal(); return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish()); ``` https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal

sauceyred commented 2025-05-04 20:58:29 +00:00

Owner

Copy link

@radical wrote in #7 (comment):

apparently actix has a built in for this, ill implement it

let mut refresh_token_cookie = refresh_token_cookie(refresh_token);

refresh_token_cookie.make_removal();

return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish());

https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal

Hell yeah

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-70: > apparently actix has a built in for this, ill implement it > > ```rs > let mut refresh_token_cookie = refresh_token_cookie(refresh_token); > > refresh_token_cookie.make_removal(); > > return Ok(HttpResponse::Unauthorized().cookie(refresh_token_cookie).finish()); > ``` > > https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.make_removal Hell yeah

radical commented 2025-05-04 20:59:08 +00:00

Author

Owner

Copy link

revoke will not be changed however, we'll have a separate endpoint for logout

revoke will not be changed however, we'll have a separate endpoint for logout

sauceyred commented 2025-05-04 20:59:36 +00:00

Owner

Copy link

@radical wrote in #7 (comment):

revoke will not be changed however, we'll have a separate endpoint for logout

Agreed

@radical wrote in https://git.gorb.app/gorb/backend/pulls/7#issuecomment-72: > revoke will not be changed however, we'll have a separate endpoint for logout Agreed

radical added 1 commit 2025-05-04 21:02:24 +00:00

feat: expire refresh_token immediately on unauthorized response c61f96ffe7

sauceyred approved these changes 2025-05-04 21:16:27 +00:00

sauceyred left a comment

Owner

Copy link

Changes work as intended.

Changes work as intended.

sauceyred changed title from WIP: wip/authorization-header to wip/authorization-header 2025-05-04 21:16:46 +00:00

radical merged commit c2bface373 into main 2025-05-04 21:18:28 +00:00

radical deleted branch wip/authorization-header 2025-05-04 21:18:28 +00:00

radical referenced this pull request from a commit 2025-05-04 21:18:29 +00:00

Merge pull request 'wip/authorization-header' (#7) from wip/authorization-header into main

Sign in to join this conversation.

Reviewers

No reviewers

sauceyred

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

radical

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: gorb/backend#7

No description provided.