Nuxt Auth how to delete refresh token from database?

user_16557170 0
Viewed 836

I am halfway through implementing Nuxt Auth (local/refresh) in my application. I have a table in the db where I store the refresh tokens and I want to delete the refresh token from the db when Nuxt Auth logs out. Nuxt Auth is not sending the refresh token to my endpoint so there is no way for me to look it up and delete it from the database.

Nuxt Auth is correctly getting both tokens and the user details on login and is correctly calling my logout API endpoint, it is just sending an empty body.

package.json:

"@nuxtjs/auth-next": "^5.0.0-1624817847.21691f1",

nuxt.config:

auth: {
  strategies: {
    local: {
      scheme: 'refresh',
      token: {
        property: 'accessToken',
        maxAge: 1800,
        global: true,
      },
      refreshToken: {
        property: 'refreshToken',
        data: 'refreshToken',
        maxAge: 60 * 60 * 24 * 30
      },
      endpoints: {
        login: {url: '/login', method: 'post'},
        refresh: { url: '/token', method: 'post'},
        logout: {url: '/logout', method: 'delete'},
        user: {url: '/user', method: 'get'}
      },
      user: {
        property: false,
      },
      tokenRequired: true,
      tokenType: 'bearer'
    }
  }
}

API Endpoint:

router.delete('/logout', async (req, res) => {
  const sql =`DELETE FROM tokens WHERE id = '${req.body.refreshToken}'`
  await pool.query(sql)
  res.sendStatus(204)
})
nuxt-auth nuxt.js refresh-token
2 Answers

You should definitely NOT send SQL over HTTP.
Either send some ID to your backend on some path like /expire or let the token expire by itself.

My company is using a 5min token expiration. Meaning that each 5 minutes, the token is expired and refreshed with the refresh_token.
You could lower this even more, to like 1min if you want.

But this is a backend question and more code of this would be needed.
Even a need question I'd say.

user_88165850

after alot of debugging and console logging here is my solution: change this.$auth.logout() (basically you call this method when you press on logout button), to this :

this.$auth.logout({
  data: {
    refreshToken: this.$auth.strategies.local.refreshToken.get(),
  },
})

PS: if you call your strategy(in nuxt.config.js) to other name than 'local', you should change also this.$auth.strategies.local.refreshToken.get(), to: this.$auth.strategies.'your strategy name'.refreshToken.get()

user_169493270
Related