Enhance Authentication with JWT and Refresh Token Mechanism #264

[gflachs]

closes #264

Description

This PR introduces a secure authentication mechanism using JWTs for access tokens and refresh tokens, replacing the current session-based authentication. It enhances security, enables frontend access to user data, and ensures token lifecycle management.

Motivation

The current authentication system has the following limitations:

1. Stolen Cookies Cannot Be Rejected: Once stolen, cookies can be perpetually renewed, preventing proper user logout.
2. Limited Frontend Access: User information is encrypted within the session cookie, making it inaccessible to the frontend.

To address these issues, JWTs for access tokens and refresh tokens are introduced.

Changes Implemented

1. JWT-Based Access Tokens

• User Data: User information is stored in a JWT, signed with the backend's private key.
• Accessibility: Stored in a frontend-accessible cookie.
• Expiration: Tokens expire after 5 minutes to limit their lifespan.

2. Refresh Tokens

• Purpose: Allows secure renewal of access tokens without requiring a full re-login.
• Storage: Stored as an HTTP-only cookie for added security.
• Validation: Refresh tokens are recorded in the database to ensure integrity.
• Expiration: Longer expiration period (e.g., several days).

3. Token Renewal Workflow

• When the access token expires, the system verifies the refresh token:
• If valid:
  *Issues a new access token.
  *Invalidates the old refresh token and generates a new one.

[Eyad-Wahdan]

Overall, this is excellent work! The code is well-structured and the functionality is clearly implemented. Great job on adding a robust JWT-based authentication mechanism. Before merging, there are a few suggestions and potential adjustments to consider that could further enhance the maintainability, security, and readability of the code. Then the code should be ready to merge!

[Eyad-Wahdan]

All suggested revisions have been addressed or justified, thank you for that! Now, only the final checks need to pass!

[sonarqubecloud]

Quality Gate passed

Issues
32 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.1% Coverage on New Code
0.7% Duplication on New Code

See analysis details on SonarQube Cloud