Method ValidateRefreshToken

internal/token/auth_token.go:334–382

Function to validate refreshToken

(gc *gin.Context, refreshToken string)

// Function to validate refreshToken
func (p *provider) ValidateRefreshToken(gc *gin.Context, refreshToken string) (map[string]interface{}, error) {
	res := make(map[string]interface{})

	if refreshToken == "" {
		return res, fmt.Errorf(`unauthorized`)
	}

	res, err := p.ParseJWTToken(refreshToken)
	if err != nil {
		return res, err
	}

	userID, ok := res["sub"].(string)
	if !ok || userID == "" {
		return res, fmt.Errorf(`unauthorized: missing sub claim`)
	}
	nonce, _ := res["nonce"].(string)

	loginMethod, _ := res["login_method"].(string)
	sessionKey := userID
	if loginMethod != "" {
		sessionKey = loginMethod + ":" + userID
	}
	token, err := p.dependencies.MemoryStoreProvider.GetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+nonce)
	if nonce == "" || err != nil {
		p.dependencies.Log.Debug().Err(err).Msgf("invalid refresh token: %v, key: %s", err, sessionKey+":"+constants.TokenTypeRefreshToken+"_"+nonce)
		return res, fmt.Errorf(`unauthorized`)
	}

	if subtle.ConstantTimeCompare([]byte(token), []byte(refreshToken)) != 1 {
		p.dependencies.Log.Debug().Msgf("invalid refresh token: %s, key: %s", err, sessionKey+":"+constants.TokenTypeRefreshToken+"_"+nonce)
		return res, fmt.Errorf(`unauthorized`)
	}

	hostname := parsers.GetHost(gc)
	if ok, err := p.ValidateJWTClaims(res, &AuthTokenConfig{
		HostName: hostname,
		Nonce:    nonce,
		User:     &schemas.User{ID: userID},
	}); !ok || err != nil {
		return res, err
	}

	if res["token_type"] != constants.TokenTypeRefreshToken {
		return res, fmt.Errorf(`unauthorized: invalid token type`)
	}

	return res, nil
}

func (p *provider) ValidateBrowserSession(gc *gin.Context, encryptedSession string) (*SessionData, error) {
	if encryptedSession == "" {