Fix access token not persisting on hard reload - #11
Conversation
- Add LoginForm, SignupForm, HealthCheck components - Add CenteredPageLayout and TextField reusable UI - Add lib/api.ts, auth.ts, config.ts, health.ts, types.ts - Use clientAction for login/signup, clientLoader for health check - Update routes to use React Router data APIs
Removed docstring explaining public access for HealthCheckAPI and simplified response structure.
Refactor authentication views to remove AuthenticationService calls and directly handle user authentication and password management. Update token handling and response structure for login and signup endpoints.
|
@redsteadz |
| * Returns a valid access token, trying memory first then refresh token. | ||
| * Used by route loaders to check auth status. | ||
| */ | ||
| export async function getValidAccessToken(): Promise<string | null> { |
There was a problem hiding this comment.
a valid access token means a token that is actually functioning, this function is only checking whether the token is present or no
There was a problem hiding this comment.
Try checking if the token is actually valid through a quick backend call
There was a problem hiding this comment.
Added a small function called isTokenExpired that decodes the JWT and compares the exp field to the current time. This gives us the same result as calling the backend would, but we skip the extra network call on every route load, so it's faster. Backend still does its own validation on real API calls, so nothing is less secure, we're just avoiding an unnecessary check upfront.
|
approved |
|
Merging it. |
4 participants
Problem
Hard reload was logging the user out even when refresh token cookie was still valid. In-memory access token gets wiped on reload, but the code never tried the refresh token as fallback.
Fix
getValidAccessToken()inlib/auth.ts, checks memory first, falls back torefreshAccessToken()if emptyProtectedLayout(loader-based route guard) for the new/authpage, redirects to/loginif no valid token foundTesting
/authredirects to/loginwhen no refresh cookie present (tested by manually deleting it from web devtool)/authkeeps user logged in when refresh cookie is validmemoryRefreshTokencookie triggers redirect correctlyFixes #8