ทำ JWT Refresh Token ด้วย Spring Boot

# JWT Config
jwtSecret=auth-spring-jwt-docker-secret-key
# 5 minutes.
jwtExpirationMs=300000
# 24 hours.
jwtRefreshExpirationMs=86400000

## For test
# 1 minute.
#jwtExpirationMs=60000
# 2 minutes.
#jwtRefreshExpirationMs= 120000

package com.demo.auth.entity.app;

import java.time.Instant;

import com.demo.auth.entity.base.BaseEntity;

import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.JoinColumn;
import jakarta.persistence.OneToOne;
import lombok.Data;

@Data
@Entity
public class RefreshToken extends BaseEntity{
    @OneToOne
    @JoinColumn(name = "user_id", referencedColumnName = "id")
    private User user;

    @Column(nullable = false, unique = true)
    private String token;

    @Column(nullable = false)
    private Instant expiryDate;
}

package com.demo.auth.repository;

import java.util.Optional;

import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Modifying;
import org.springframework.stereotype.Repository;

import com.demo.auth.entity.app.RefreshToken;
import com.demo.auth.entity.app.User;

@Repository
public interface RefreshTokenRepository extends JpaRepository<RefreshToken,Long>{
    Optional<RefreshToken> findByToken(String token);
    Optional<RefreshToken> findByUser(User user);

    @Modifying
    int deleteByUser(User user);
}

package com.demo.auth.exception;

import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.http.HttpStatus;

@ResponseStatus(HttpStatus.FORBIDDEN)
public class TokenRefreshException extends RuntimeException {
    private static final long serialVersionUID = 1L;

    public TokenRefreshException(String token, String message) {
      super(String.format("Failed for [%s]: %s", token, message));
    }
}

package com.demo.auth.security.services;

import java.time.Instant;
import java.util.Optional;
import java.util.UUID;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

import com.demo.auth.entity.app.RefreshToken;
import com.demo.auth.entity.app.User;
import com.demo.auth.repository.RefreshTokenRepository;
import com.demo.auth.repository.UserRepository;
import com.demo.auth.exception.TokenRefreshException;

@Service
public class RefreshTokenService {

    @Value("${jwtRefreshExpirationMs}")
    private Long refreshTokenDurationMs;

    @Autowired
    private RefreshTokenRepository refreshTokenRepository;

    @Autowired
    private UserRepository userRepository;

    public Optional<RefreshToken> findByToken(String token) {
        return refreshTokenRepository.findByToken(token);
    }

    public RefreshToken createRefreshToken(Long userId) {
        User user = userRepository.findById(userId).get();

        Optional<RefreshToken> oldRefreshToken = refreshTokenRepository.findByUser(user);
        if(oldRefreshToken.isPresent()){
            refreshTokenRepository.deleteByUser(user);
        }

        RefreshToken refreshToken = new RefreshToken();

        refreshToken.setUser(user);
        refreshToken.setExpiryDate(Instant.now().plusMillis(refreshTokenDurationMs));
        refreshToken.setToken(UUID.randomUUID().toString());

        refreshToken = refreshTokenRepository.save(refreshToken);
        return refreshToken;
    }

    public RefreshToken verifyExpiration(RefreshToken token) {
        if (token.getExpiryDate().compareTo(Instant.now()) < 0) {
            refreshTokenRepository.delete(token);
            throw new TokenRefreshException(token.getToken(), "Refresh token was expired. Please make a new signin request");
        }

        return token;
    }
}

package com.demo.auth.payload.request;

import jakarta.validation.constraints.NotBlank;
import lombok.Data;

@Data
public class TokenRefreshRequest {
    @NotBlank
    private String refreshToken;
}

package com.demo.auth.payload.response;

import lombok.Data;

@Data
public class TokenRefreshResponse {
    private String accessToken;
    private String refreshToken;
    private String tokenType = "Bearer";

    public TokenRefreshResponse(String accessToken, String refreshToken) {
        this.accessToken = accessToken;
        this.refreshToken = refreshToken;
    }
}

package com.demo.auth.advice;

import java.util.Date;

import lombok.Data;

@Data
public class ErrorMessage {
    private int statusCode;
    private Date timestamp;
    private String message;
    private String description;
  
    public ErrorMessage(int statusCode, Date timestamp, String message, String description) {
      this.statusCode = statusCode;
      this.timestamp = timestamp;
      this.message = message;
      this.description = description;
    }
}

//...
public class JwtResponse {

    //...
    private String refreshToken;

    //...

    public JwtResponse(
        //...
        String refreshToken, 
        //...
        ) 
    {
        //...
        this.refreshToken = refreshToken;
        //...
    }
}

package com.demo.auth.security.jwt;

import java.io.IOException;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import com.demo.auth.entity.app.RefreshToken;
import com.demo.auth.security.services.RefreshTokenService;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.log4j.Log4j2;

import java.util.Optional;

@Log4j2
@Component
public class AuthTokenFilter extends OncePerRequestFilter{

    //...

	@Autowired
	private RefreshTokenService refreshTokenService;

    @Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
			throws ServletException, IOException {
		try {
			//...

			String rft = parseRft(request);
			Optional<RefreshToken> refreshTokenOpt = refreshTokenService.findByToken(rft);
			
			RefreshToken refreshToken = null;
			if(refreshTokenOpt.isPresent()){
				refreshToken = refreshTokenService.verifyExpiration(refreshTokenOpt.get());
			}

			//...
		} catch (Exception e) {
			log.error("Cannot set user authentication: {}", e);
		}

		filterChain.doFilter(request, response);
	}

    //...

	private String parseRft(HttpServletRequest request) {
		String headerRft = request.getHeader("RefreshToken");
		if (StringUtils.hasText(headerRft)) {
			return headerRft;
		}

		return null;
	}
    
}

package com.demo.auth.advice;

import java.util.Date;

import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestControllerAdvice;
import org.springframework.web.context.request.WebRequest;

import com.demo.auth.exception.TokenRefreshException;

@RestControllerAdvice
public class TokenControllerAdvice {

    @ExceptionHandler(value = TokenRefreshException.class)
    @ResponseStatus(HttpStatus.FORBIDDEN)
    public ErrorMessage handleTokenRefreshException(TokenRefreshException ex, WebRequest request) {
        return new ErrorMessage(
            HttpStatus.FORBIDDEN.value(),
            new Date(),
            ex.getMessage(),
            request.getDescription(false));
    }

}

import com.demo.auth.entity.app.RefreshToken;

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping("/auth")
public class AuthController {
    //...

    @Autowired
  	RefreshTokenService refreshTokenService;

    @PostMapping("/signin")
	public ResponseEntity<?> authenticateUser(@Valid @RequestBody SigninRequest req) {
        //...
        UserDetailsImpl userDetails = (UserDetailsImpl) authentication.getPrincipal();	
		String jwt = jwtUtil.generateJwtToken(userDetails);
        //...
        RefreshToken refreshToken = refreshTokenService.createRefreshToken(userDetails.getId());

        return ResponseEntity.ok(new JwtResponse(
                                                //...
												refreshToken.getToken()
                                                //...
                                                 ));
    }
}

import com.demo.auth.entity.app.RefreshToken;

import com.demo.auth.payload.request.TokenRefreshRequest;
import com.demo.auth.payload.response.TokenRefreshResponse;
import com.demo.auth.exception.TokenRefreshException;

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping("/auth")
public class AuthController {
    //...

    @PostMapping("/refreshtoken")
	public ResponseEntity<?> refreshtoken(@Valid @RequestBody TokenRefreshRequest request) {
		String requestRefreshToken = request.getRefreshToken();

		return refreshTokenService.findByToken(requestRefreshToken)
			.map(refreshTokenService::verifyExpiration)
			.map(RefreshToken::getUser)
			.map(user -> {
					String token = jwtUtil.generateTokenFromUsername(user.getUsername());
					return ResponseEntity.ok(new TokenRefreshResponse(token, requestRefreshToken));
				}
			)
			.orElseThrow(() -> new TokenRefreshException(requestRefreshToken,"Refresh token is not in database!"));
	}
}

if(pm.response.code === 200){
    pm.environment.set("AccessToken",pm.response.json().token);
    pm.environment.set("RefreshToken",pm.response.json().refreshToken);
}

import http from '@/constants/api';
import TokenService from '@/services/token'
import EventBus from '@/utils/event-bus'

const setup = (store) => {
    http.interceptors.response.use(
        (res) => {
          return res;
        },
        async (err) => {
          const originalConfig = err.config;
    
          if (originalConfig.url !== "/auth/signin" && err.response) {
            // Access Token was expired
            if (err.response.status === 401 && !originalConfig._retry) {
              originalConfig._retry = true;
    
              try {
                const rs = await http.post("/auth/refreshtoken", {
                  refreshToken: TokenService.getLocalRefreshToken(),
                });
    
                const { accessToken } = rs.data;
    
                store.dispatch('auth/refreshtoken', accessToken);
                TokenService.updateLocalAccessToken(accessToken);
    
                return http(originalConfig);
              } catch (_error) {
                EventBus.dispatch("logout");
                return Promise.reject(_error);
              }
            }
          }
    
          return Promise.reject(err);
        }
      );
};

export default setup;

JWT token is expired: JWT expired at 2023-03-18T13:51:18Z. Current time: 2023-03-18T14:06:59Z, 
a difference of 941979 milliseconds.  Allowed clock skew: 0 milliseconds.