JWT Refresh Token and interceptor mechanism

During the development of the "refresh token" and "Remember me" mechanisms by following recommendations shared in this website for instance, I've started to raise some doubts on the approach.

So, I've started to think on possible tricky situations that I would like to share before taking a decision. As you can see below, I'm using an interceptor to automatically send a refresher request if I'm facing an error 401:

export const REFRESHER_TOKEN_INTERCEPTOR = new HttpContextToken(() => false);
export const authInterceptor: HttpInterceptorFn = (
req: HttpRequest<any>,
next,
) => {
const authService = inject(AuthService);
const operationName = req.body.operationName.toLowerCase();
const isRefresherToken =
operationName.toLowerCase() === "refreshtoken" ? true : false;
//By dafault, the interceptor will try to pass the JWT token but for the refresherToken we must pass the refresher token instead
const jwtToken = authService.getToken(isRefresherToken);
console.log(`JWTToken:${jwtToken}`);
if (jwtToken) {
const cloned = req.clone({
setHeaders: {
Authorization: `Bearer ${jwtToken}`,
},
});
return next(cloned).pipe(
catchError((err: any) => {
if (err instanceof HttpErrorResponse)
switch (err.status) {
case 401:
return authService.refreshToken().pipe(
switchMap(() => {
const jwtToken = authService.getToken();
const newCloned = req.clone({
setHeaders: {
Authorization: `Bearer ${jwtToken}`,
},
});
return next(newCloned);
}),
);
}
return throwError(() => err);
}),
);
}
return next(req);
};



It works, however, I'm facing the tricky situation that if the user is closing the navigator and opening later on, he can access directly to any pages that he was able before..... that's overpass the need to develop the remember me feature of the login page

I have the strange feeling that I'm missing something important....

Initially, I was quite confused by using the refresh token mechanism....

Notes:

• My application is fully based on graphql
• I'm currently using localstorage for JWT access and JWT Refresh token before implementing cookies to "optimize" the security but for the moment it's perfect for debugging.

Continue reading...