Repository navigation
feat: JWT認証のリフレッシュトークンと有効期限のトークンの処理ロジック - #153
Justhiro55 wants to merge 3 commits into
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR enhances the JWT authentication flow by adding refresh-token support, logout handling, and tuning token lifetimes.
- Extend
Loginto issue both access and refresh tokens, plus a newRefreshTokenusecase method - Introduce refresh-token claims, issuance, and verification in
app/packages/utils/auth/user.go - Add
/logoutand/refreshroutes and handlers, setting/clearing cookies appropriately
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| app/usecase/auth.go | Updated Login signature, error wrapping, and added RefreshToken |
| app/packages/utils/auth/user.go | Defined refreshTokenClaims and implemented Issue/VerifyRefreshToken |
| app/interfaces/server.go | Registered /logout and /refresh HTTP routes |
| app/interfaces/handler/auth.go | Updated SignIn to set refresh cookie, added Logout, CheckAuth, RefreshToken handlers |
| app/configs/config.go | Imported strings and added IsProduction helper |
Comments suppressed due to low confidence (4)
app/interfaces/handler/auth.go:278
- Specify Path: "/" on the refreshed access-token cookie so it's sent with all routes, not just the current path.
cookie := &http.Cookie{
app/interfaces/server.go:86
- Add unit or integration tests for the new
/logoutendpoint to verify cookies are cleared correctly.
s.Router.Post("/logout", authHandler.Logout)
app/interfaces/server.go:88
- Add tests for the
/refreshendpoint to cover valid, missing, and expired/invalid refresh-token scenarios.
s.Router.Post("/refresh", authHandler.RefreshToken)
app/usecase/auth.go:102
- Add a doc comment for
RefreshTokendescribing its behavior, inputs, and returned values.
func (a *AuthUseCase) RefreshToken(refreshToken string) (string, error) {
| return nil, "", "", errors.New("failed to generate JWT token") | ||
| } | ||
|
|
||
| refreshToken, err := auth.IssueRefreshToken(user.UserID) | ||
| if err != nil { | ||
| return nil, "", "", errors.New("failed to generate refresh token") |
There was a problem hiding this comment.
Wrap the original error when JWT issuance fails (e.g., fmt.Errorf("failed to generate JWT token: %w", err)) to preserve context.
| return nil, "", "", errors.New("failed to generate JWT token") | |
| } | |
| refreshToken, err := auth.IssueRefreshToken(user.UserID) | |
| if err != nil { | |
| return nil, "", "", errors.New("failed to generate refresh token") | |
| return nil, "", "", fmt.Errorf("failed to generate JWT token: %w", err) | |
| } | |
| refreshToken, err := auth.IssueRefreshToken(user.UserID) | |
| if err != nil { | |
| return nil, "", "", fmt.Errorf("failed to generate refresh token: %w", err) |
|
|
||
| refreshToken, err := auth.IssueRefreshToken(user.UserID) | ||
| if err != nil { | ||
| return nil, "", "", errors.New("failed to generate refresh token") |
There was a problem hiding this comment.
Wrap the underlying error when refresh-token issuance fails (e.g., fmt.Errorf("failed to generate refresh token: %w", err)).
| return nil, "", "", errors.New("failed to generate refresh token") | |
| return nil, "", "", fmt.Errorf("failed to generate refresh token: %w", err) |
| } | ||
|
|
||
| var refreshTokenJwt = &hs256jwt{ | ||
| sigKey: []byte("SKNGIonriongINIOnfiar394rjOJGg"), |
There was a problem hiding this comment.
Avoid hardcoding JWT signing keys in source; load this secret from configuration or environment variables.
There was a problem hiding this comment.
.env作成は別タスクに切り分けるのでここではハードコーディングの状態を許容することにします
| if c.Exp < now.Unix() { | ||
| return fmt.Errorf("token expired: %d (now:%d)", c.Exp, now.Unix()) | ||
| } | ||
| if c.TokenType != "refresh" { |
There was a problem hiding this comment.
[nitpick] Define a constant for the token type string (e.g., const RefreshTokenType = "refresh") instead of hardcoding it.
| if c.TokenType != "refresh" { | |
| if c.TokenType != RefreshTokenType { |
| } | ||
|
|
||
| // アクセストークンをクッキーに設定 | ||
| cookie := &http.Cookie{ |
There was a problem hiding this comment.
Set HttpOnly: true, Path: "/", and consider SameSite and Secure attributes on the access-token cookie to improve security.
|
|
||
| // リフレッシュトークンを別のクッキーに設定 | ||
| refreshCookie := &http.Cookie{ | ||
| Name: "refresh_token", |
There was a problem hiding this comment.
[nitpick] Centralize cookie names ("token", "refresh_token") into package-level constants to reduce duplication and typos.
| Name: "refresh_token", | |
| Name: CookieRefreshToken, |
概要
#149
JWT認証システムを改善．
リフレッシュトークン機能，ログアウト処理を実装してセキュリティ周り修正しました．
変更点