Set jwt key names in .env

Author: bdmendes

.env

@@ -1 +1,4 @@
-PUBLIC_API_URL=http://localhost:8080
+PUBLIC_API_URL=http://localhost:8080
+PUBLIC_JWT_ACCESS_KEY=access_token
+PUBLIC_JWT_REFRESH_KEY=refresh_token
+PUBLIC_COOKIE_MAX_AGE=604800

src/hooks.server.ts

@@ -1,4 +1,5 @@
-import { appendCookieHeader, JWT_ACCESS_KEY, JWT_REFRESH_KEY } from '$lib/auth';
+import { appendCookieHeader } from '$lib/auth';
+import { PUBLIC_JWT_ACCESS_KEY, PUBLIC_JWT_REFRESH_KEY } from '$env/static/public';
 import type { Handle } from '@sveltejs/kit';
 
 async function _handleAuthentication(apiResponse: Response): Promise<Response> {
@@ -9,14 +10,14 @@ async function _handleAuthentication(apiResponse: Response): Promise<Response> {
   const serverResponse = new Response(apiResponse.clone().body, apiResponse);
   const json = await apiResponse.json();
 
-  const accessToken = json[JWT_ACCESS_KEY];
+  const accessToken = json[PUBLIC_JWT_ACCESS_KEY];
   if (accessToken) {
-    appendCookieHeader(serverResponse, JWT_ACCESS_KEY, accessToken);
+    appendCookieHeader(serverResponse, PUBLIC_JWT_ACCESS_KEY, accessToken);
   }
 
-  const refreshToken = json[JWT_REFRESH_KEY];
+  const refreshToken = json[PUBLIC_JWT_REFRESH_KEY];
   if (refreshToken) {
-    appendCookieHeader(serverResponse, JWT_REFRESH_KEY, refreshToken);
+    appendCookieHeader(serverResponse, PUBLIC_JWT_REFRESH_KEY, refreshToken);
   }
 
   return serverResponse;

src/lib/auth.ts

@@ -1,11 +1,8 @@
-export const JWT_ACCESS_KEY = 'access_token';
-export const JWT_REFRESH_KEY = 'refresh_token';
-
-const COOKIE_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
+import { PUBLIC_COOKIE_MAX_AGE } from '$env/static/public';
 
 export async function appendCookieHeader(response: Response, name: string, value: string) {
   response.headers.append(
     'Set-Cookie',
-    `${name}=${value}; HttpOnly; Max-Age=${COOKIE_MAX_AGE}; Path=/; SameSite=Strict`
+    `${name}=${value}; HttpOnly; Max-Age=${PUBLIC_COOKIE_MAX_AGE}; Path=/; SameSite=Strict`
   );
 }

src/routes/api/[...endpoint]/proxy.ts

@@ -1,8 +1,8 @@
-import { PUBLIC_API_URL } from '$env/static/public';
+import { PUBLIC_API_URL, PUBLIC_JWT_REFRESH_KEY, PUBLIC_JWT_ACCESS_KEY } from '$env/static/public';
 import type { Cookies } from '@sveltejs/kit';
-import { JWT_REFRESH_KEY, JWT_ACCESS_KEY, appendCookieHeader } from '$lib/auth';
+import { appendCookieHeader } from '$lib/auth';
 
-async function _fetchAdapter(
+async function _fetchApi(
   relativeUrl: URL | string,
   method: string,
   body?: string | null,
@@ -15,19 +15,15 @@ async function _fetchAdapter(
 }
 
 async function _refreshAccessToken(cookies: Cookies): Promise<string | null> {
-  const refreshToken = cookies.get(JWT_REFRESH_KEY);
-  const response = await _fetchAdapter(
-    'auth/refresh',
-    'POST',
-    JSON.stringify({ token: refreshToken })
-  );
+  const refreshToken = cookies.get(PUBLIC_JWT_REFRESH_KEY);
+  const response = await _fetchApi('auth/refresh', 'POST', JSON.stringify({ token: refreshToken }));
 
   if (!response.ok) {
     return null;
   }
 
   const json = await response.json();
-  return json[JWT_ACCESS_KEY];
+  return json[PUBLIC_JWT_ACCESS_KEY];
 }
 
 export async function fetchWithAuth(
@@ -37,16 +33,16 @@ export async function fetchWithAuth(
   headers?: HeadersInit,
   body?: string | null
 ): Promise<Response> {
-  const jwt = cookies.get(JWT_ACCESS_KEY);
+  const jwt = cookies.get(PUBLIC_JWT_ACCESS_KEY);
 
   if (!jwt) {
-    return _fetchAdapter(relativeUrl, method, body, new Headers(headers));
+    return _fetchApi(relativeUrl, method, body, new Headers(headers));
   }
 
   const authHeaders = new Headers(headers);
   authHeaders.append('Authorization', `Bearer ${jwt}`);
 
-  const response = await _fetchAdapter(relativeUrl, method, body, authHeaders);
+  const response = await _fetchApi(relativeUrl, method, body, authHeaders);
 
   const unauthorized = response.status >= 401 && response.status <= 403;
   if (unauthorized) {
@@ -58,11 +54,11 @@ export async function fetchWithAuth(
     const newAuthHeaders = new Headers(headers);
     newAuthHeaders.set('Authorization', `Bearer ${accessToken}`);
 
-    const newResponse = await _fetchAdapter(relativeUrl, method, body, newAuthHeaders);
+    const newResponse = await _fetchApi(relativeUrl, method, body, newAuthHeaders);
 
     if (newResponse.ok) {
       const newResponseWithCookies = new Response(newResponse.clone().body, newResponse);
-      appendCookieHeader(newResponseWithCookies, JWT_ACCESS_KEY, accessToken);
+      appendCookieHeader(newResponseWithCookies, PUBLIC_JWT_ACCESS_KEY, accessToken);
       return newResponseWithCookies;
     }
   }

src/routes/api/auth/logout/+server.ts

@@ -1,9 +1,9 @@
-import { JWT_ACCESS_KEY, JWT_REFRESH_KEY } from '$lib/auth';
+import { PUBLIC_JWT_ACCESS_KEY, PUBLIC_JWT_REFRESH_KEY } from '$env/static/public';
 import type { RequestHandler } from '@sveltejs/kit';
 
 export const POST: RequestHandler = async (event) => {
-  const accessToken = event.cookies.get(JWT_ACCESS_KEY);
-  const refreshToken = event.cookies.get(JWT_REFRESH_KEY);
+  const accessToken = event.cookies.get(PUBLIC_JWT_ACCESS_KEY);
+  const refreshToken = event.cookies.get(PUBLIC_JWT_REFRESH_KEY);
   if (!accessToken || !refreshToken) {
     return new Response(
       JSON.stringify({
@@ -23,11 +23,11 @@ export const POST: RequestHandler = async (event) => {
   );
   response.headers.append(
     'Set-Cookie',
-    `${JWT_ACCESS_KEY}=; HttpOnly; Max-Age=0; Path=/; SameSite=Strict`
+    `${PUBLIC_JWT_ACCESS_KEY}=; HttpOnly; Max-Age=0; Path=/; SameSite=Strict`
   );
   response.headers.append(
     'Set-Cookie',
-    `${JWT_REFRESH_KEY}=; HttpOnly; Max-Age=0; Path=/; SameSite=Strict`
+    `${PUBLIC_JWT_REFRESH_KEY}=; HttpOnly; Max-Age=0; Path=/; SameSite=Strict`
   );
   return response;
 };