Repository navigation
Add an opt-in refresher that renews the JWT cookie - #2
Merged
Merged
Conversation
The cookie strategy can now ask a configured refresher for a new token while it authenticates a request; the middleware writes the result to the cookie unless the request revokes the token. The default refresher re-issues a still-valid token past half its lifetime. Apps subclass it to recover expired sessions or apply their own lifetime rules. Claude-Session: https://claude.ai/code/session_01CmZXZEDaL3ZbsgNLro2JXv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
MLH Core needs to renew browser sessions centrally whenever it handles an authenticated request, so callers don't have to know about a refresh endpoint (review on MLH-Engineering/core#3406). This gem is where the cookie is read and written, so it gets an opt-in hook with a simple default, and Core supplies its own session rules.
What changes
jwt_cookie.refreshersetting,nilby default. With no refresher set, behaviour is unchanged.Devise::JWT::Cookie::Refresheris the default implementation. It re-issues a still-valid token once it is past half its lifetime, and calls the model'son_jwt_dispatchsoAllowlistrecords the newjti. A revoked, expired or wrong-scope token is never renewed.A refresher is any object that responds to
call(token, scope, env)and returns a new JWT, ornilto keep the current one.Verification
bundle exec rake spec(Ruby 3.2): 37 examples, 0 failures, including newspec/features/token_refresh_spec.rb, which covers no refresher, a token before and after half-life, a revoked token, and a subclass recovering without a token. RuboCop is clean.Release
Core will depend on
~> 0.7.0once it's published to RubyGems.Opened by a Claude Code agent on behalf of @jonmarkgo.
https://claude.ai/code/session_01CmZXZEDaL3ZbsgNLro2JXv
Need help on this PR? Tag
@codesmith-botwith what you need.