For authentication with the web platform, add JWT auth.
We need a refresh token and an access token.
Resource protected endpoints shall require a valid Authorization Bearer token from the header
Authorization: "Bearer er.pLZ......."
-
The AccessToken should be created from user claims (email and id).
-
It should have a maximum validity of 60 minutes
-
It should be checked on authorrized routes (to be done later)
-
The refreshToken should be string, maximum of 200 characters
-
It should be stored in the database in a separate table (with columns: id, userId, token, expiresOnUtc)
-
It should have a maximum validity of 3 months
The app should generate both access and refresh token on login or account creation.
If the access token is expired on login or when a resource needs authorization, but the refresh token is still valid, the system generates a new accesstoken and proceeds with the request.
If the refresh token expires, require sign in from the user.
For authentication with the web platform, add JWT auth.
We need a refresh token and an access token.
Resource protected endpoints shall require a valid Authorization Bearer token from the header
Authorization: "Bearer er.pLZ......."The AccessToken should be created from user claims (email and id).
It should have a maximum validity of 60 minutes
It should be checked on authorrized routes (to be done later)
The refreshToken should be string, maximum of 200 characters
It should be stored in the database in a separate table (with columns: id, userId, token, expiresOnUtc)
It should have a maximum validity of 3 months
The app should generate both access and refresh token on login or account creation.
If the access token is expired on login or when a resource needs authorization, but the refresh token is still valid, the system generates a new accesstoken and proceeds with the request.
If the refresh token expires, require sign in from the user.