Feature/auth logout

[pvdev1805]

This pull request introduces token blacklisting for JWT access and refresh tokens by integrating Redis as a centralized blacklist store. It ensures that tokens can be invalidated immediately upon logout or refresh, enhancing security against token reuse. The implementation includes new configuration, service, and controller logic, as well as necessary dependency and configuration updates.

Token Blacklisting and Security Enhancements:

• Added LogoutService to handle blacklisting of access and refresh tokens in Redis, including methods to add tokens to the blacklist and check their status. (src/main/java/com/be08/smart_notes/service/LogoutService.java)
• Implemented a custom BlacklistFilter in SecurityConfig that checks for blacklisted access tokens on every request and blocks access if the token is invalidated. (src/main/java/com/be08/smart_notes/config/SecurityConfig.java)
• Updated AuthenticationService to:
  • Blacklist used refresh tokens during token refresh and prevent reuse of blacklisted tokens.
  • Provide a logout method to blacklist the current access token. (src/main/java/com/be08/smart_notes/service/AuthenticationService.java) [1] [2] [3] [4]
• Added a /logout endpoint to AuthenticationController to allow users to invalidate their current access token. (src/main/java/com/be08/smart_notes/controller/AuthenticationController.java)

Redis Integration:

• Added Redis dependencies and Jackson JSR310 support to pom.xml for storing blacklisted tokens and handling Java 8 date/time serialization. (pom.xml)
• Created RedisConfig to configure a RedisTemplate bean for use in the application. (src/main/java/com/be08/smart_notes/config/RedisConfig.java)
• Added Redis connection properties to application.properties. (src/main/resources/application.properties)

JWT Improvements:

• Modified JwtService to include a unique token ID (jti) in every JWT, which is used for blacklist tracking. (src/main/java/com/be08/smart_notes/service/JwtService.java) [1] [2]

These changes collectively enable secure, immediate invalidation of JWTs, preventing their use after logout or refresh, and lay the groundwork for robust session management in the application.