[Feature] 로그아웃, 토큰 재발급 #14
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
minje0204
approved these changes
Sep 24, 2024
| refreshToken = extractToken(refreshToken); | ||
| accessToken = extractToken(accessToken); | ||
|
|
||
| validateAccessTokenExpired(accessToken); |
There was a problem hiding this comment.
AccessToken 유효성검사를 하는 메서드로 보이는데 맞을까요?
아니면 Access token이 진짜 만료되었는지 체크하는껄까요?
There was a problem hiding this comment.
Access Token이 진짜 만료되었는지 체크하는 메서드입니다. Refresh Token을 얻은 공격자가 재발급을 통해 Access Token을 탈취하는 것을 방지하고자 넣은 로직입니다.
There was a problem hiding this comment.
이해했습니다 그렇게 악용될 수 도 있겠네요!
|
|
||
| public void reissue(String refreshToken, String accessToken, HttpServletResponse response) { | ||
| refreshToken = extractToken(refreshToken); | ||
| accessToken = extractToken(accessToken); |
There was a problem hiding this comment.
매개변수에 재할당보다는 새롭게 변수를 만들어주는게 좋을 것 같아요!
| validateAccessTokenExpired(accessToken); | ||
| String providerId = jwtTokenProvider.parseExpiredToken(accessToken).getSubject(); | ||
|
|
||
| validateRefreshToken(refreshToken, providerId); |
There was a problem hiding this comment.
[OPTIONAL]
Token이라는 도메인 class를 만든다면 validate 하는 부분을 도메인 class에 넣어서 캡슐화시킬 수도 있을 것 같네요
There was a problem hiding this comment.
원래 토큰 담당자가 JwtTokenProvider인데, 여기에다가 validate 하도록 수정할까요?
|
충돌나는 부분 수정해두었습니답 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
✏️ Description
🙏🏻 To Reviewers
💡 Issue Number