My backend sends a refresh token as a cookie after the login happens.
Although this cookie does not get persisted after closing or refreshing my Next.js page.
I am sending the refresh token cookie after loginIn as a server side cookie so its secure.
This is the login logic:
@Post('/login')
@UsePipes(new ZodValidationPipe(authenticateBodySchema))
async login(
@Body() body: AuthenticateBodySchema,
@Res({ passthrough: true }) response: Response,
) {
const { email, password } = body
const user = await this.authService.validateUser(email, password)
const { senha, ...userWithoutPassword } = user
const token = this.authService.generateAccessToken(user.id)
const refreshToken = this.authService.generateRefreshToken(user.id)
response.cookie('refreshToken', refreshToken, {
path: '/',
httpOnly: true,
secure: this.configService.getOrThrow('ENVIRONMENT') === 'PRODUCTION',
sameSite: true,
maxAge: 7 * 24 * 60 * 60 * 1000,
})
return { token, user: userWithoutPassword }
}
@Post('/refresh')
async refresh(
@Req() request: Request,
@Res({ passthrough: true }) response: Response,
) {
const refreshToken = request.cookies.refreshToken
const { sub, user } =
await this.authService.validateRefreshToken(refreshToken)
const generatedAccessToken = this.authService.generateAccessToken(sub)
const generatedRefreshToken = this.authService.generateRefreshToken(sub)
const { senha, ...userWithoutPassword } = user
response.cookie('refreshToken', generatedRefreshToken, {
path: '/',
httpOnly: true,
secure: this.configService.getOrThrow('ENVIRONMENT') === 'PRODUCTION',
sameSite: false,
maxAge: 7 * 24 * 60 * 60 * 1000,
})
return { token: generatedAccessToken, user: userWithoutPassword }
}
Main.js of Nest.js:
import { NestFactory } from '@nestjs/core'
import { AppModule } from './app.module'
import { ConfigService } from '@nestjs/config'
import { Env } from './env'
import * as cookieParser from 'cookie-parser'
async function bootstrap() {
const app = await NestFactory.create(AppModule, {
cors: {
origin: ['http://localhost:3001', 'https://mywebsite.vercel.app'],
credentials: true,
},
})
app.use(cookieParser())
const configService: ConfigService<Env, true> = app.get(ConfigService)
const port = configService.get('PORT', { infer: true })
await app.listen(port)
}
bootstrap()
After login in I get:
The login logic in Next.js is:
const signIn = async (email: string, password: string) => {
const response = await AuthService.login(email, password)
const decodedToken = jwtDecode(response.token)
if (!decodedToken.exp) {
toast('Erro ao fazer login')
return
}
destroyCookie(undefined, 'mywebsite-token')
const tokenExpiration = (decodedToken?.exp * 1000 - Date.now()) / 1000
setCookie(undefined, 'mywebsite-token', response.token, {
maxAge: tokenExpiration,
})
http.defaults.headers.Authorization = `Bearer ${response.token}`
setUser(response.user)
router.replace('/receitas')
}