Overhaul refresh token property

[pilcrowOnPaper]

Now saves an encrypted version of the refresh token inside cookies instead of the refresh token. Also rotates refresh tokens for added security.

Jul. 21, 2022

• [Breaking] Lucia saves encrypted_refresh_token instead of refresh_token
• [Breaking] authenticateUser() and createUser() returns a different object
• [Breaking] Lucia requires env config
• [Breaking] fingerprint cookie is renamed to fingerprint_token
• [Breaking] Refresh tokens are re-issued when access tokens are refreshed and the old token is invalidated.
• [Breaking] autoRefreshAccessToken and refreshAccessToken (client) are replaced by autoRefreshTokens and refreshTokens respectively
• [Breaking] All refresh tokens prior to this update is invalid
• [Breaking] types LuciaUser and LuciaSvelteKitSession is renamed to User and SvelteKitSession
• [Breaking] refreshAccessToken (server) is replaced by refreshTokens
• All refresh tokens belonging to a user will be invalidated if a token refresh is attempted using a previous refresh token
• Refresh tokens and fingerprint tokens are now stored for 1 year instead of 5
• All cookies are deleted if a invalid refresh token or fingerprint token is passed

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
lucia-sveltekit	✅ Ready (Inspect)	Visit Preview	Jul 22, 2022 at 5:41AM (UTC)