mirror of
https://github.com/ajurna/cbwebreader.git
synced 2026-11-02 10:36:55 +00:00
ajurna
79c0647cc4
- Introduced `CookieJWTAuthentication` for authentication via HttpOnly cookies, enabling browser-initiated requests without `Authorization` headers. - Added authentication views (`CookieTokenObtainPairView`, `CookieTokenRefreshView`, `CookieTokenBlacklistView`) to replace default SimpleJWT views. - Updated Vuex store and frontend logic to handle sessions using HttpOnly cookies instead of localStorage. - Enhanced backend and frontend configurations (Django settings, router, Vuex, and API service) to fully support cookie-based authentication. - Updated authentication tests to ensure correct cookie handling and authentication flows.
54 lines
1.7 KiB
JavaScript
54 lines
1.7 KiB
JavaScript
import axios from "axios";
|
|
import router from "@/router";
|
|
import store from "@/store";
|
|
|
|
// Authentication is cookie based: the browser sends the HttpOnly access token
|
|
// automatically, so there is no Authorization header to set here.
|
|
const axios_jwt = axios.create({ withCredentials: true });
|
|
|
|
// Add the CSRF header if a csrftoken cookie exists. Cookie authentication is
|
|
// protected against cross-site form posts by SameSite=Lax, so this is only used
|
|
// when the backend does set the cookie.
|
|
axios_jwt.interceptors.request.use(function(config) {
|
|
const csrfToken = document.cookie
|
|
.split('; ')
|
|
.find(row => row.startsWith('csrftoken='))
|
|
?.split('=')[1];
|
|
|
|
if (csrfToken) {
|
|
config.headers['X-CSRFToken'] = csrfToken;
|
|
}
|
|
|
|
return config;
|
|
});
|
|
|
|
// A 401 means the access cookie is no longer valid. Try to refresh it once; if
|
|
// that fails the session is gone, so log out and send the user to the login page.
|
|
axios_jwt.interceptors.response.use(
|
|
(response) => response,
|
|
async (error) => {
|
|
const config = error.config;
|
|
|
|
if (error.response?.status === 401 && config && !config._retried && !config.url.includes('/token/')) {
|
|
config._retried = true;
|
|
try {
|
|
await store.dispatch('refreshToken');
|
|
return await axios_jwt.request(config);
|
|
} catch {
|
|
store.commit('logOut');
|
|
router.push({
|
|
name: 'login',
|
|
query: {
|
|
next: config.url,
|
|
error: 'Your session has expired. Please log in again.'
|
|
}
|
|
});
|
|
}
|
|
}
|
|
|
|
return Promise.reject(error);
|
|
}
|
|
);
|
|
|
|
export default axios_jwt
|