john-okeefe
8a6ea39ed2
- Add comprehensive authentication overview.md explaining: - 7-day session duration for JWT and refresh tokens - Constants-based implementation (no hardcoded values) - Complete authentication flow (register/login/refresh/logout) - Session expiration handling (HTML redirect vs JSON error) - Security features (HTTP-only cookies, token rotation) - Token storage recommendations - Update login.md with 7-day expires_in field and cookie MaxAge - Update register.md with 7-day session duration details - Update refresh_token.md with expires_in: 604800 Documentation provides complete reference for authentication endpoints with examples and security considerations.
1.1 KiB
1.1 KiB
Login User
Authenticate with email and password.
Endpoint: POST /api/auth/login
Auth: Not required
Content-Type: application/json or application/x-www-form-urlencoded
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
| login | string | Yes | User's email address or username |
| password | string | Yes | User's password |
Example Request
{
"login": "user@example.com",
"password": "SecureP@ss123!"
}
Response (200 OK)
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "d4f5g6h7...",
"token_type": "Bearer",
"expires_in": 604800,
"user": {
"id": "uuid-here",
"email": "user@example.com",
"username": "john",
"first_name": "John",
"last_name": "Doe",
"role": "user"
}
}
Set-Cookie Header:
Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly
Session Duration: 7 days (604800 seconds)
Error Responses
| Code | Description |
|---|---|
| 401 | Invalid email or password |
| 400 | Missing required fields |
| 429 | Too many login attempts |