feat(Middleware): JWT refresh tokens #3856

SolidProgramming · 2025-10-30T15:36:28Z

No description provided.

[+] Added `revokeRefreshToken` mutation to revoke tokens by setting `revoked_at`. [+] Added `storeRefreshToken` mutation to insert new tokens into the database.

…air` classes to handle token-related data and operations. [~] Updated `AuthQueries` static constructor to initialize refresh token queries.

…. (WIP)

[~] create table if not exists refresh token for upgrade script 9.0

[+] Token validation on api querys

[~] Updated `Authenticate` method to remove `sessionStorage` dependency. [~] Switched from `string` JWT to `TokenPair` for session restoration. [~] Improved error handling for null `AccessToken` during session restore.

remove unused `sessionStorage` parameter.

…tion in `fworch-texts.sql`. [+] Introduced `AccessTokenLifetimeHours` and `RefreshTokenLifetimeDays` properties in `ConfigData.cs`. [+] Added UI elements in `SettingsDefaults.razor` for configuring token lifetimes with validation.

…rewall-orchestrator into feature_1689

Introduced a new `RevokeToken` endpoint in `AuthenticationTokenController` to explicitly revoke refresh tokens. Updated `RefreshTokenInfo` to include `created_at` and `revoked_at` fields. Enhanced `TokenService` to revoke tokens during logout and renamed `ClearTokenPair` to `RevokeTokens`. Refactored `UiUserHandler` to dynamically fetch expiration times based on configuration keys. Updated `JwtWriter` and `CreateTokenPair` to use configurable token lifetimes (`AccessTokenLifetimeHours` and `RefreshTokenLifetimeDays`). Improved code readability by replacing `var` with explicit types, enhancing formatting, and adding better error handling. Removed unused imports and added necessary ones for compatibility. CactuseSecurity#1689

Removed `ITokenRefreshService` interface and refactored token management to consolidate operations within `TokenService`. Updated `TokenService` to use record-style constructor syntax, added XML documentation, and introduced new methods for token handling (`SetTokenPair`, `RevokeTokens`). Removed redundant methods and fields, modernized dependency injection, and improved token persistence with `ProtectedSessionStorage`.

Changed exception type in `UiUserHandler.cs` for better clarity and added a fallback mechanism for missing database values. Adjusted `Logout.razor` to ensure proper deauthentication before resource cleanup. Simplified `TokenService` by removing `RefreshAccessToken`, making `Initialize` private, and ensuring token initialization in `IsAccessTokenExpired` and `RevokeTokens`.

Expanded and clarified API authentication documentation in HelpApiLogin.cshtml. Added localized texts for token actions and error messages, and provided detailed examples for login, token refresh, and revoke endpoints, including error scenarios and expected responses. Introduced .small-helpage CSS class for clearer response labeling. Enhances user guidance and internationalization for API authentication.

Removed [Order] attribute from all test classes to allow default test execution order. Minor change in Program.cs regarding JwtBearer usage, but no functional impact. fixed sonarqube csharpsquid:S125 in Program.cs

Changed JWT token retrieval endpoint from /Get to /GetTokenPair/ in test-api.yml and test-auth.yml. Updates both valid and invalid credentials test cases to use the new endpoint.

Removed commented-out and redundant ldapmodify tasks from modify_ldap_tree.yml. The playbook now only includes essential steps for adding or modifying the integration_testuser_jwt entry and for adding sample tenants, operators, and groups. Conditional logic and legacy code for roles and groups have been eliminated, resulting in a more streamlined and maintainable playbook.

sonarqubecloud · 2025-12-19T09:42:58Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

This PR implements JWT refresh token functionality to improve authentication security and user experience. The implementation adds a two-token system (access + refresh tokens) with automatic token rotation, secure hash-based storage in the database, and client-side token management.

Key changes:

New refresh token system with database storage using SHA256 hashing
Automatic token refresh in UI when access tokens expire
Token rotation on refresh for enhanced security

Reviewed changes

Copilot reviewed 52 out of 53 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
`roles/ui/files/FWO.UI/Services/TokenService.cs`	New service managing token lifecycle (refresh, revoke, storage)
`roles/middleware/files/FWO.Middleware.Server/Controllers/AuthenticationTokenController.cs`	New endpoints for token refresh and revocation
`roles/ui/files/FWO.UI/Shared/MainLayout.razor`	Token refresh logic on navigation and initialization
`roles/database/files/upgrade/9.0.sql`	New refresh_tokens table with expiration/revocation tracking
`roles/lib/files/FWO.Data/Middleware/TokenPair.cs`	Data model for access+refresh token pairs
`roles/tests-unit/files/FWO.Test/TokenServiceTest.cs`	Comprehensive unit tests for TokenService
`roles/tests-unit/files/FWO.Test/AuthenticationTokenIntegrationTest.cs`	Integration tests for token workflows
`roles/ui/files/FWO.UI/Auth/AuthStateProvider.cs`	Updated authentication flow to use TokenPair
`roles/lib/files/FWO.Config.Api/Data/ConfigData.cs`	New config parameters for token lifetimes

Comments suppressed due to low confidence (2)

roles/ui/files/FWO.UI/Pages/Settings/SettingsDefaults.razor:310

This foreach loop implicitly filters its target sequence - consider filtering the sequence explicitly using '.Where(...)'.
roles/middleware/files/FWO.Middleware.Server/UiUserHandler.cs:184
This foreach loop immediately maps its iteration variable to another variable - consider mapping the sequence explicitly using '.Select(...)'.

                foreach (string group in groupsOfUser)
                {
                    string groupName = new DistName(group).Group;
                    if (!MatchesNamingConvention(groupName, namingConvention))
                    {
                        continue; // skip groups that do not match the naming convention
                    }
                    FwoOwner? owner = FindOwnerWithMatchingGroupName(groupName, allOwners);

                    if (owner != null)
                    {
                        user.Ownerships.Add(owner.Id);
                    }
                }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-19T16:04:07Z

roles/ui/files/FWO.UI/Shared/MainLayout.razor

+    private async void OnLocationChanged(object? sender, LocationChangedEventArgs e)
    {
-        if (e == null || string.IsNullOrEmpty(e.UserDn))
+        if (LastLocation != e.Location)
        {
-            return;
+            LastLocation = e.Location;
+
+            await CheckAndRefreshTokenAsync();
        }
+    }


The OnLocationChanged event handler is marked as async void, which is problematic. Exceptions thrown in async void methods cannot be caught by the caller and will crash the application. This should be changed to async Task and errors should be properly handled. Additionally, there's no unsubscription of this event handler in the Dispose method, which could lead to memory leaks.

Copilot · 2025-12-19T16:04:07Z

roles/ui/files/FWO.UI/wwwroot/css/site.css

    top: calc(var(--bs-custom-modal-margin-top) + 1em - 1px);
+}
+
+.small-helpage {


The CSS class name contains a typo. "helpage" should be "helptext" or "help-text" to properly indicate this is styling for help text content.

Copilot · 2025-12-19T16:04:08Z

roles/ui/files/FWO.UI/Services/TokenService.cs

+            await refreshSemaphore.WaitAsync();
+
+            try
+            {
+                if (!await IsAccessTokenExpired())
+                {
+                    return true;
+                }


There is a potential race condition in the token refresh logic. The semaphore is acquired at line 114, but the token expiration is checked again at line 118. However, if multiple concurrent requests pass the initial check at line 154 (before acquiring the semaphore), they will all queue up. When the first request completes the refresh and releases the semaphore, subsequent requests will check expiration again at line 118 and may return true without refreshing (since the token was just refreshed), but this still results in multiple attempts hitting the middleware. Consider adding a check immediately after acquiring the semaphore to verify if another request has already refreshed the token.

Copilot · 2025-12-19T16:04:08Z

roles/tests-unit/files/FWO.Test/AuthenticationTokenIntegrationTest.cs

+            {
+                // Spin up local test server using WebApplicationFactory
+                Log.WriteInfo("Test Setup", "Creating WebApplicationFactory for local testing");
+                factory = new WebApplicationFactory<Program>()


Disposable 'WebApplicationFactory' is created but not disposed.

Copilot · 2025-12-19T16:04:08Z

roles/ui/files/FWO.UI/Shared/MainLayout.razor

                }
-                catch (Exception) { }
-                Log.WriteError(( title != "" ? title : "Unspecified Error" ), ( message != "" ? message : "Unspecified error occured: " ), exception, userConfig.User.Name, role);
+                catch(Exception) { }


Poor error handling: empty catch block.

Copilot · 2025-12-19T16:04:09Z

roles/tests-unit/files/FWO.Test/ConfigFileTest.cs

+            Assert.That(ConfigFile.ApiServerUri, Is.Null);
+
+            Assert.DoesNotThrow(() => { var _ = ConfigFile.MiddlewareServerUri; });
+            Assert.DoesNotThrow(() => { var _ = ConfigFile.ApiServerUri; });


This assignment to _ is useless, since its value is never read.

Copilot · 2025-12-19T16:04:09Z

roles/tests-unit/files/FWO.Test/ConfigFileTest.cs

-            Assert.Catch(typeof(ApplicationException), () => { var _ = ConfigFile.JwtPublicKey; });
+
+            Assert.That(ConfigFile.JwtPublicKey, Is.Null);
+            Assert.DoesNotThrow(() => { var _ = ConfigFile.JwtPublicKey; });


This assignment to _ is useless, since its value is never read.

Copilot · 2025-12-19T16:04:09Z

roles/tests-unit/files/FWO.Test/ConfigFileTest.cs

-            Assert.Catch(typeof(ApplicationException), () => { var _ = ConfigFile.JwtPrivateKey; });
+
+            Assert.That(ConfigFile.JwtPrivateKey, Is.Null);
+            Assert.DoesNotThrow(() => { var _ = ConfigFile.JwtPrivateKey; });


This assignment to _ is useless, since its value is never read.

Copilot · 2025-12-19T16:04:09Z

roles/ui/files/FWO.UI/Pages/Login.razor

                        <input type="password" class="form-control @InputClass" id="PasswordInput" placeholder="@(globalConfig.GetText("password"))" value="@Password" @oninput="OnPasswordInput">
                    </div>
-                    @if (loginInProgress == false)
+                    @if(loginInProgress == false)


The expression 'A == false' can be simplified to '!A'.

Copilot · 2025-12-19T16:04:10Z

roles/ui/files/FWO.UI/Pages/Login.razor

                    <input type="password" class="form-control @InputClass" id="NewPasswordInput2" placeholder="@(userConfig.GetText("new_password"))" value="@newPassword2" @oninput="OnNewPassword2Input">
                </div>
-                @if (passwordChangeInProgress == false)
+                @if(passwordChangeInProgress == false)


The expression 'A == false' can be simplified to '!A'.

[+] Added getRefreshToken query to retrieve valid tokens by hash.

7d1f39f

[+] Added `revokeRefreshToken` mutation to revoke tokens by setting `revoked_at`. [+] Added `storeRefreshToken` mutation to insert new tokens into the database.

SolidProgramming self-assigned this Oct 30, 2025

SolidProgramming and others added 28 commits October 30, 2025 16:54

[+] Introduced RefreshTokenInfo, RefreshTokenRequest, and `TokenP…

000a0c6

…air` classes to handle token-related data and operations. [~] Updated `AuthQueries` static constructor to initialize refresh token queries.

[+] GenerateRefreshToken

0bf04f6

[+] Added support for access and refresh tokens across backend and UI…

9a5fd50

…. (WIP)

[~] fix csharpsquid:S112

66b5c64

[+] Added refresh_tokens table for token management

717c6b2

[+] create table refresh tokens

138725c

[~] create table if not exists refresh token for upgrade script 9.0

[+] Token Service

ad8ca5d

[+] Token validation on api querys

[~] anon auth failing

5674b83

[+] Add session storage support for token management

c467a33

WIP

f0de903

Merge branch 'importer-rework' into feature_1689

545b12a

.

1dec96c

[~] Refactor auth flow and improve token handling

ea3adf7

[~] Updated `Authenticate` method to remove `sessionStorage` dependency. [~] Switched from `string` JWT to `TokenPair` for session restoration. [~] Improved error handling for null `AccessToken` during session restore.

[~] Refactored Authenticate in AuthStateProvider.cs to

a8f9f9b

remove unused `sessionStorage` parameter.

[~] Deauth token clear on logout

d45e6d4

Merge branch 'importer-rework' into feature_1689

eb6fd03

Merge branch 'feature_1689' of https://github.com/SolidProgramming/fi…

7453bf8

…rewall-orchestrator into feature_1689

replace hasura metadata

c225a80

Merge branch 'importer-rework' into feature_1689

0dcb13c

Merge branch 'importer-rework' into feature_1689

3726177

.

6cd381d

Merge branch 'importer-rework' into feature_1689

bce2301

Merge branch 'importer-rework' into feature_1689

fe47596

Merge branch 'feature_1689' of https://github.com/SolidProgramming/fi…

d5b16de

…rewall-orchestrator into feature_1689

SolidProgramming and others added 24 commits December 11, 2025 16:36

.

00da643

cleanup + test fix (used old endpoint)

89a118c

refactor(test): remove NUnit [Order] from test classes

6d723e7

Removed [Order] attribute from all test classes to allow default test execution order. Minor change in Program.cs regarding JwtBearer usage, but no functional impact. fixed sonarqube csharpsquid:S125 in Program.cs

fix warning

b8b6231

.

e8b28b7

fix(auth): update JWT token endpoint in test files

fd21af4

Changed JWT token retrieval endpoint from /Get to /GetTokenPair/ in test-api.yml and test-auth.yml. Updates both valid and invalid credentials test cases to use the new endpoint.

Pad base64 string before decoding to avoid Incorrect padding error

b9eac53

.

da2b65d

jwt debug

3ca2cda

jwt debug

61e31c1

debug jwt

b6c397c

jwt debug

3fbb241

jwt debug

48d2dee

jwt debug

a043356

jwt debug

01cc0f7

jwt debug

4a38870

jwt debug

72d88d1

integration test user

7750e85

delete integration test user from ldap

3d28ea0

.

ecf527a

Merge branch 'importer-rework' into feature_1689

d758350

Merge branch 'importer-rework' into feature_1689

c6ee9e5

SolidProgramming marked this pull request as ready for review December 19, 2025 15:56

Copilot AI review requested due to automatic review settings December 19, 2025 15:56

Copilot started reviewing on behalf of SolidProgramming December 19, 2025 15:56 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

SolidProgramming marked this pull request as draft December 19, 2025 16:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(Middleware): JWT refresh tokens #3856

feat(Middleware): JWT refresh tokens #3856

SolidProgramming commented Oct 30, 2025

Uh oh!

sonarqubecloud bot commented Dec 19, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Copilot AI Dec 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

feat(Middleware): JWT refresh tokens #3856

Are you sure you want to change the base?

feat(Middleware): JWT refresh tokens #3856

Conversation

SolidProgramming commented Oct 30, 2025

Uh oh!

sonarqubecloud bot commented Dec 19, 2025

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant