Problems with guardian - how generate access and refresh token in login

Question

To invalidate JWTs, people use one of two methods

• blacklist/whitelist (with guardian_db).
• a refresh token (which allows regenerating access tokens) with a short expiring access token.

I dont want to use guardian_db in my project. So, how i generate access token and refresh token in the login endpoint?

My code is:

File mix.ex

    # Authentication library
    {:guardian, "~> 1.0"}

File config.exs

    # Guardian configuration
    config :my_proj, MyProj.Guardian,
        issuer: "my_proj",
        verify_module: Guardian.JWT,
        secret_key: "Xxxxxxxxxxxxxxxxxxxxxxxxxx",
        allowed_drift: 2000,
        verify_issuer: true,
        ttl: {5, :minutes}

    # Ueberauth configuration
    config :ueberauth, Ueberauth,
        base_path: "/api/auth",
        providers: [
        identity: {
            Ueberauth.Strategy.Identity,
            [
                callback_methods: ["POST"],
                callback_path: "/api/auth/login",
                nickname_field: :email,
                param_nesting: "account",
                uid_field: :email
            ]
            }
        ]

File aut_access_pipeline.ex

    defmodule MyProjWeb.Plug.AuthAccessPipeline do
        use Guardian.Plug.Pipeline, otp_app: :my_proj

        plug(Guardian.Plug.VerifySession, claims: %{"typ" => "access"})
        plug(Guardian.Plug.VerifyHeader, claims: %{"typ" => "access"})
        plug(Guardian.Plug.EnsureAuthenticated)
        plug(Guardian.Plug.LoadResource, ensure: true)
        plug(MyProjWeb.Plug.CurrentUser)
        plug(MyProjWeb.Plug.CheckToken)
    end

File auth_controller.ex

    defmodule MyProjWeb.AuthenticationController do
        def login(conn, %{"email" => email, "password" => password}) do
            case Accounts.get_user_by_email_and_password(email, password) do
                {:ok, user} ->
                    handle_login_response(conn, user, "login.json")

                {:error, _reason} ->
                    conn
                    |> put_status(:unauthorized)
                    |> Error.render(:invalid_credentials)
                    |> halt
            end
        end

        def refresh(conn, %{"jwt" => existing_jwt}) do
            case MyProj.Guardian.refresh(existing_jwt, ttl: {5, :minutes}) do
                {:ok, {_old_token, _old_claims}, {new_jwt, _new_claims}} ->
                    current_user = current_resource(conn)
                    user = MyProj.Accounts.get_user!(current_user.id)

                    conn
                    |> put_resp_header("authorization", "Bearer #{new_jwt}")
                    |> render(MyProjWeb.AuthenticationView, json_file, %{jwt: new_jwt, user: user})
                {:error, _reason} ->
                    conn
                    |> put_status(:unauthorized)
                    |> Error.render(:invalid_credentials)
            end
        end

        defp handle_login_response(conn, user, json_file) do
            new_conn = MyProj.Guardian.Plug.sign_in(conn, user, [])
            jwt = MyProj.Guardian.Plug.current_token(new_conn)
            %{"exp" => exp} = MyProj.Guardian.Plug.current_claims(new_conn)

            new_conn
            |> put_resp_header("authorization", "Bearer #{jwt}")
            |> put_resp_header("x-expires", "#{exp}")
            |> render(MyProjWeb.AuthenticationView, json_file, %{jwt: jwt, user: user})
        end
    end
end

File guardian.ex

    defmodule MyProj.Guardian do
        use Guardian, otp_app: :my_proj

        def subject_for_token(user = %User{}, _claims),
            do: {:ok, "User:#{user.id}"}

        def subject_for_token(_user, _claims) do
            {:error, :no_resource_id}
        end

        def resource_from_claims(%{"sub" => "User:" <> id}) do
            {:ok, MyProj.Accounts.get_user!(id)}
        end

        def resource_from_claims(_claims) do
            {:error, :no_claims_sub}
        end
    end

With this code i have a valid token for access but i dont know how generate the refresh token for regenerate/refresh the access token when he expires...

anyone can help?

Answer 1

My solution is something like this...

In the login endpoint i respond with 2 tokens (access and refresh) ...

new_conn =
  MyProj.Guardian.Plug.sign_in(
    conn,
    credentials,
    %{},
    token_type: "refresh"
  )

jwt_refresh = MyProj.Guardian.Plug.current_token(new_conn)

{:ok, _old_stuff, {jwt, %{"exp" => exp} = _new_claims}} =
  MyProj.Guardian.exchange(jwt_refresh, "refresh", "access")

Basically the solution is to use the MyProj.Guardian.exchange(...)

In the refresh endpoint i respond with the new access token ...

def refresh(conn, %{"jwt_refresh" => jwt_refresh}) do
case MyProj.Guardian.exchange(jwt_refresh, "refresh", "access") do
  {:ok, _old_stuff, {jwt, %{"exp" => exp} = _new_claims}} ->
    conn
    |> put_resp_header("authorization", "Bearer #{jwt}")
    |> put_resp_header("x-expires", "#{exp}")
    |> render(MyProjWeb.AuthenticationView, "refresh.json", %{jwt: jwt})

  {:error, _reason} ->
    conn
    |> put_status(:unauthorized)
    |> Error.render(:invalid_credentials)
end
end

Answer 2

I'm using an older version of Guardian, so my code is a little different, but if you want to do it in the same endpoint you can match a grant_type parameter in the body

def login(conn, %{"grant_type" => "password"} = params) do
 case User.find_and_confirm_password(params) do
  {:ok, user} ->
    new_conn = GP.api_sign_in(conn, user, :token, perms: User.permissions(user))
    jwt = GP.current_token(new_conn)
    {:ok, claims} = GP.claims(new_conn)
    exp = Map.get(claims, "exp") -
      (DateTime.utc_now() |> DateTime.to_unix())

    new_conn
    |> put_resp_header("authorization", "Bearer #{jwt}")
    |> put_resp_header("x-expires", "Bearer #{exp}")
    |> render(SessionView, "login.json", jwt: jwt, exp: exp)
  {:error, changeset} ->
    conn
    |> put_status(401)
    |> render(IIMWeb.ChangesetView, "error.json", changeset: changeset)
end

end

def login(conn, %{"grant_type" => "refresh_token"} = params) do
  jwt = GP.current_token(conn)
  with {:ok, claims} <- GP.claims(conn),
    logged_user_id when not is_nil(logged_user_id) <-
      GP.current_resource(conn)[:id],
    user <- Repo.get!(User, logged_user_id),
    {:ok, new_jwt, new_claims} <- Guardian.refresh!(jwt, claims,
      perms: User.permissions(user))
  do
    exp = Map.get(new_claims, "exp") - (DateTime.utc_now() |> DateTime.to_unix())
    conn
    |> put_resp_header("authorization", "Bearer #{new_jwt}")
    |> put_resp_header("x-expires", "Bearer #{exp}")
    |> render(SessionView, "login.json", jwt: new_jwt, exp: exp)
  else
    {:error, reason} ->
      changeset = %Login{}
      |> Login.changeset(params)
      |> Changeset.add_error(:refresh_token, to_string(reason))
      conn
      |> put_status(401)
      |> render(IIMWeb.ChangesetView, "error.json", changeset: changeset)
end

end

As you can see I am using the same endpoint but depending on the grant_type it receives a password or an old token( this request must be done a few seconds before the old token expires) I changed the exp time from future timestamp for time in milliseconds because of the timezones in frontend, but you can use it like you want.