jwt_sessions 2.2.0 → 2.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d92af5c82b767203a340f54627281a85eb5576ed
-  data.tar.gz: dce1a37bba83687b2815e757475d00e3f0a21fef
+  metadata.gz: 7b04e83f8dac3d2546364665988101a1a1fd6193
+  data.tar.gz: 9a84c2705ec41817a6ed79a5bdface8f5da48dba
 SHA512:
-  metadata.gz: cc9b3e0a4bea5bab7560c38d8cb24b15b94f289c82acc9581206af29eed9890f0aa4987c126a59540ed6b1f02d126159714212e4fb08f6d470232d8f08b3eeb8
-  data.tar.gz: f689a7cc6c5de3bf0d8ffec6bc3d20d0abc86b1a71ab85b33a782c5a1fad491baaaedf449032e62547bd2b8fdc7a833d7f5ecb569d476077abec70dc3a3c354b
+  metadata.gz: fc621aa40e3c9f4b5807655ee4198f8881cdb00814d32fa159fbf815f1061c47190456316606b67e4c4743b13a2c74a7fb1b1bea99219f8b4207beb693f263a2
+  data.tar.gz: c1bfcd3b9198dbdc641aa71dffaa8d0f9a1866dcb3ed800e690b967466a6f0d509daece7a3f58f45104d763aa4a7aafad0cb136608f91659f4d13db2fa64fc9a

data/README.md

@@ -34,13 +34,11 @@ Main goal of this gem is to provide configurable, manageable, and safe stateful
 
 It's designed to be framework agnostic yet is easily integrable so Rails integration is also available out of the box.
 
-Core concept behind jwt_sessions is that each session is represented by a pair of tokens: access and refresh,
-and a session store used to handle CSRF checks and refresh token hijacking. Default token store is based on redis
-but you can freely implement your own store with whichever backend you prefer.
+Core concept behind `jwt_sessions` is that each session is represented by a pair of tokens: access and refresh, and a session store is used to handle CSRF checks and refresh token hijacking. Both tokens have configurable expiration times, but in general refresh token is supposed to have a longer lifespan than an access token. Access token is used to retrieve secured resources and refresh token is used to renew the access token once it's expired. Default token store is based on redis.
+
+All tokens are encoded and decoded by [ruby-jwt](https://github.com/jwt/ruby-jwt) gem, and its reserved claim names are supported as well as it's allowed to configure claim checks and cryptographic signing algorithms supported by it.
+`jwt_sessions` itself uses `ext` claim and `HS256` signing by default.
 
-All tokens are encoded and decoded by [ruby-jwt](https://github.com/jwt/ruby-jwt) gem, and its reserved claim names are supported
-as well as it's allowed to configure claim checks and cryptographic signing algorithms supported by it.
-jwt_sessions itself uses `ext` claim and `HS256` signing by default.
 
 ## Installation
 
@@ -58,7 +56,7 @@ bundle install
 
 ## Getting Started
 
-`Authorization` mixin is supposed to be included in your controllers and is used to retrieve access and refresh tokens from incoming requests and verify CSRF token if needed.
+`Authorization` mixin is supposed to be included in your controllers and is used to retrieve access and refresh tokens from incoming requests and verify CSRF token if needed. It assumes that a token is either in a cookie or in a header (cookie and header names are configurable). It tries to retrieve it from headers first, then from cookies (CSRF check included) if the headers check failed.
 
 ### Rails integration
 
@@ -139,7 +137,7 @@ session = JWTSessions::Session.new(payload: payload, refresh_payload: refresh_pa
 ```
 
 Now you can build a refresh endpoint. To protect the endpoint use before_action `authorize_refresh_request!`. \
-In the example `found_token` - is a token fetched from request headers or cookies.
+The endpoint itself should return a renewed access token.
 
 ```ruby
 class RefreshController < ApplicationController
@@ -156,7 +154,7 @@ class RefreshController < ApplicationController
   end
 end
 ```
-
+In the example `found_token` - is a token fetched from request headers or cookies. In the context of `RefreshController` it's a refresh token. \
 The refresh request with headers must include `X-Refresh-Token` (header name is configurable) with refresh token.
 
 ```
@@ -275,7 +273,7 @@ class SimpleApp < Sinatra::Base
     payload.to_json
   end
 
-  ....
+  # ...
 end
 ```
 
@@ -466,7 +464,10 @@ Flush a session by its access token.
 ```ruby
 session = JWTSessions::Session.new(refresh_by_access_allowed: true)
 tokens = session.login
-session.flush_by_access_token(tokens[:access]) # => 1
+session.flush_by_access_payload
+# or
+session = JWTSessions::Session.new(refresh_by_access_allowed: true, payload: payload)
+session.flush_by_access_payload
 ```
 
 Or by refresh token UID
@@ -514,6 +515,52 @@ To logout with an access token `refresh_by_access_allowed` setting should be set
 [Rails API](test/support/dummy_api) \
 [Sinatra API](test/support/dummy_sinatra_api)
 
+You can use a mixed approach for the cases when you'd like to store an access token in localStorage and refresh token in HTTP-only secure cookies. \
+Rails controllers setup example:
+
+```ruby
+class LoginController < ApplicationController
+  def create
+    user = User.find_by(email: params[:email])
+    if user&.authenticate(params[:password])
+
+      payload = { user_id: user.id, role: user.role, permissions: user.permissions }
+      refresh_payload = { user_id: user.id }
+      session = JWTSessions::Session.new(payload: payload, refresh_payload: refresh_payload)
+      tokens = session.login
+      response.set_cookie(JWTSessions.refresh_cookie,
+                          value: tokens[:refresh],
+                          httponly: true,
+                          secure: Rails.env.production?)
+
+      render json: { access: tokens[:access], csrf: tokens[:csrf] }
+    else
+      render json: 'Cannot login', status: :unauthorized
+    end
+  end
+end
+
+class RefreshController < ApplicationController
+  before_action :authorize_refresh_request!
+
+  def create
+    tokens = JWTSessions::Session.new(payload: access_payload).refresh(found_token)
+    render json: { access: tokens[:access], csrf: tokens[:csrf] }
+  end
+
+  def access_payload
+    user = User.find_by!(email: payload['user_id'])
+    { user_id: user.id, role: user.role, permissions: user.permissions }
+  end
+end
+
+class ResourcesController < ApplicationController
+  before_action :authorize_access_request!
+  before_action :validate_role_and_permissions_from_payload
+
+  # ...
+end
+```
 
 ## Contributing
 

data/lib/jwt_sessions/session.rb

@@ -187,6 +187,14 @@ module JWTSessions
       }
     end
 
+    def refresh_tokens_hash
+      {
+        csrf: csrf_token,
+        access: access_token,
+        access_expires_at: Time.at(@_access.expiration.to_i)
+      }
+    end
+
     def check_refresh_on_time
       expiration = @_refresh.access_expiration
       yield @_refresh.uid, expiration if expiration.to_i > Time.now.to_i
@@ -197,7 +205,7 @@ module JWTSessions
       create_access_token
       update_refresh_token
 
-      tokens_hash
+      refresh_tokens_hash
     end
 
     def update_refresh_token

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = '2.2.0'
+  VERSION = '2.2.1'
 end

data/test/units/jwt_sessions/test_session.rb

@@ -5,7 +5,8 @@ require 'jwt_sessions'
 
 class TestSession < Minitest::Test
   attr_reader :session, :payload, :tokens
-  EXPECTED_KEYS = %i[access access_expires_at csrf refresh refresh_expires_at].freeze
+  LOGIN_KEYS = %i[access access_expires_at csrf refresh refresh_expires_at].freeze
+  REFRESH_KEYS = %i[access access_expires_at csrf].freeze
 
   def setup
     JWTSessions.encryption_key = 'encrypted'
@@ -22,14 +23,14 @@ class TestSession < Minitest::Test
 
   def test_login
     decoded_access = JWTSessions::Token.decode(tokens[:access]).first
-    assert_equal EXPECTED_KEYS, tokens.keys.sort
+    assert_equal LOGIN_KEYS, tokens.keys.sort
     assert_equal payload[:test], decoded_access['test']
   end
 
   def test_refresh
     refreshed_tokens = session.refresh(tokens[:refresh])
     decoded_access = JWTSessions::Token.decode(refreshed_tokens[:access]).first
-    assert_equal EXPECTED_KEYS, refreshed_tokens.keys.sort
+    assert_equal REFRESH_KEYS, refreshed_tokens.keys.sort
     assert_equal payload[:test], decoded_access['test']
   end
 
@@ -41,7 +42,7 @@ class TestSession < Minitest::Test
     refreshed_tokens = session.refresh_by_access_payload
     access2 = session.instance_variable_get('@_access')
     decoded_access = JWTSessions::Token.decode(refreshed_tokens[:access]).first
-    assert_equal EXPECTED_KEYS, refreshed_tokens.keys.sort
+    assert_equal REFRESH_KEYS, refreshed_tokens.keys.sort
     assert_equal payload[:test], decoded_access['test']
     assert_equal session.instance_variable_get('@_refresh').uid, decoded_access['ruid']
     assert_equal access2.expiration > access1.expiration, true
@@ -54,7 +55,7 @@ class TestSession < Minitest::Test
     refreshed_tokens = session.refresh_by_access_payload
     decoded_access = JWTSessions::Token.decode!(refreshed_tokens[:access]).first
     JWTSessions.access_exp_time = 3600
-    assert_equal EXPECTED_KEYS, refreshed_tokens.keys.sort
+    assert_equal REFRESH_KEYS, refreshed_tokens.keys.sort
     assert_equal payload[:test], decoded_access['test']
     assert_equal session.instance_variable_get('@_refresh').uid, decoded_access['ruid']
   end
@@ -68,7 +69,7 @@ class TestSession < Minitest::Test
     end
     decoded_access = JWTSessions::Token.decode!(refreshed_tokens[:access]).first
     JWTSessions.access_exp_time = 3600
-    assert_equal EXPECTED_KEYS, refreshed_tokens.keys.sort
+    assert_equal REFRESH_KEYS, refreshed_tokens.keys.sort
     assert_equal payload[:test], decoded_access['test']
     assert_equal session.instance_variable_get('@_refresh').uid, decoded_access['ruid']
   end
@@ -100,7 +101,7 @@ class TestSession < Minitest::Test
       raise JWTSessions::Errors::Unauthorized
     end
     decoded_access = JWTSessions::Token.decode(refreshed_tokens[:access]).first
-    assert_equal EXPECTED_KEYS, refreshed_tokens.keys.sort
+    assert_equal REFRESH_KEYS, refreshed_tokens.keys.sort
     assert_equal payload[:test], decoded_access['test']
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.2.1
 platform: ruby
 authors:
 - Yulia Oletskaya
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-25 00:00:00.000000000 Z
+date: 2018-08-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt