groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-25 02:31:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(auth): refresh tokens authentication in API and WebSocket requests

Browse source
This commit is contained in:
mikiher 2026-07-16 18:58:44 +03:00
parent 59c7d0275c
commit 8ec547e302
2 changed files with 168 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
server/auth/TokenManager.js
View file

@ -66,6 +66,18 @@ class TokenManager {
})
}
/**
* Whether a decoded JWT payload may authenticate API/socket requests (not refresh-only credentials).
*
* @param {Object} decoded
* @returns {boolean}
*/
static isBearerAccessTokenPayload(decoded) {
if (!decoded?.userId) return false
if (decoded.type === 'refresh') return false
return true
}
/**
* Function to validate a jwt token for a given user
* Used to authenticate socket connections
@ -76,7 +88,9 @@ class TokenManager {
*/
static validateAccessToken(token) {
try {
return jwt.verify(token, TokenManager.TokenSecret)
const decoded = jwt.verify(token, TokenManager.TokenSecret)
if (!TokenManager.isBearerAccessTokenPayload(decoded)) return null
return decoded
} catch (err) {
return null
}
@ -282,7 +296,11 @@ class TokenManager {
done(null, user)
} else {
// JWT based authentication
// JWT based authentication — refresh tokens are only valid at POST /auth/refresh
if (!TokenManager.isBearerAccessTokenPayload(jwt_payload)) {
done(null, null)
return
}
// Check if the jwt is expired
if (jwt_payload.exp && jwt_payload.exp < Date.now() / 1000) {