[FEATURE REQUEST] - Check for expired token

[go4cas]

Firstly ... I really enjoy the simplicity of this plugin!! Quick and easy to use!

From what I can see, $auth.check() currently only checks for the existence of the token in storage.

Tokens may expire after a period time. In this scenario, if one clicks on a route (just an example) that requires auth, the check will pass because the token is in localstorage, but when a request is sent to the API, a 401 is returned.

So, it would be great if the $auth.check() could include a check for expiry - maybe using the exp from the token?

[d0whc3r]

Yes, you are correct, this plugin do not check expiracy or validity of the token.
You could use fetchData to verify token expiracy and validity.
Token in front can be manipulated and can not be verified because signature key was not in front.

You could add in options something like this:

fetchData: {
    url: '/auth/user',
    method: 'GET',
    interval: 30,
    enabled: true,
  },

This will fetch user info at /auth/user every 30minutes, if anyone of requests status code is 401 plugin will delete token and logout user

[go4cas]

Thanks, @d0whc3r. I can work with that for now.

Maybe, as a future requirement you could have separate options for userInfo and for refreshToken. I think a lot of API's will usually separate those endpoints.

Thanks again for the quick response!

[go4cas]

@d0whc3r ... I have used your suggestion, and here's an extract from my config:

  fetchData: {
    url: '/auth/me',
    method: 'GET',
    interval: 5,
    enabled: true
  }

The /auth/me endpoint now includes a new token for the user in the response payload.

After 5 minutes I can see the /auth/me request being called in the dev tools network tab, but the token in localstorage is not updated. Any ideas?

[go4cas]

It looks like the user object (in localstorage) is updated, but not the token.

[d0whc3r]

No, only the user is updated in fetchData, if you need to update the token, you need to login again
In which case do you need to update the token?
I will add a new option in fetchData for update the token

[d0whc3r]

Ok, I decided to implement refresh method #80 once it passes the pipeline I will merge it, also documentation was extended to reflect this change 😄

[d0whc3r]

version 1.1.4 was published and it includes refresh option, check documentation to know how it works
https://d0whc3r.github.io/vue-auth-plugin/guide/#refreshdata
https://d0whc3r.github.io/vue-auth-plugin/guide/methods.html#refresh-token

[go4cas]

Legend! Thanks, @d0whc3r! I can work with this!

I am going to log another feature request to include a separate refresh token - will add detail to the issue.

[go4cas]

Added feature request #82.