john-okeefe
8a6ea39ed2
- Add comprehensive authentication overview.md explaining: - 7-day session duration for JWT and refresh tokens - Constants-based implementation (no hardcoded values) - Complete authentication flow (register/login/refresh/logout) - Session expiration handling (HTML redirect vs JSON error) - Security features (HTTP-only cookies, token rotation) - Token storage recommendations - Update login.md with 7-day expires_in field and cookie MaxAge - Update register.md with 7-day session duration details - Update refresh_token.md with expires_in: 604800 Documentation provides complete reference for authentication endpoints with examples and security considerations.
67 lines
1.5 KiB
Markdown
67 lines
1.5 KiB
Markdown
# Register User
|
|
|
|
Create a new user account.
|
|
|
|
**Endpoint**: `POST /api/auth/register`
|
|
**Auth**: Not required
|
|
**Content-Type**: `application/json` or `application/x-www-form-urlencoded`
|
|
|
|
## Request Body
|
|
|
|
| Field | Type | Required | Description |
|
|
|--------|------|-----------|-------------|
|
|
| email | string | Yes | User's email address |
|
|
| username | string | Yes | Desired username (3-50 chars) |
|
|
| password | string | Yes | Password (min 8 chars, must meet complexity requirements) |
|
|
| first_name | string | No | User's first name |
|
|
| last_name | string | No | User's last name |
|
|
|
|
### Example Request
|
|
|
|
```json
|
|
{
|
|
"email": "user@example.com",
|
|
"username": "john",
|
|
"password": "SecureP@ss123!",
|
|
"first_name": "John",
|
|
"last_name": "Doe"
|
|
}
|
|
```
|
|
|
|
## Response (201 Created)
|
|
|
|
```json
|
|
{
|
|
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
|
"refresh_token": "d4f5g6h7...",
|
|
"token_type": "Bearer",
|
|
"expires_in": 604800,
|
|
"user": {
|
|
"id": "uuid-here",
|
|
"email": "user@example.com",
|
|
"username": "john",
|
|
"first_name": "John",
|
|
"last_name": "Doe",
|
|
"role": "user",
|
|
"theme": "tokyo-night",
|
|
"created_at": "2026-01-31T10:00:00Z"
|
|
}
|
|
}
|
|
```
|
|
|
|
**Set-Cookie Header**:
|
|
```
|
|
Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly
|
|
```
|
|
|
|
**Session Duration**: 7 days (604800 seconds)
|
|
|
|
**First User**: The first user registered automatically becomes an admin.
|
|
|
|
## Error Responses
|
|
|
|
| Code | Description |
|
|
|------|-------------|
|
|
| 400 | Invalid email format, weak password, or missing fields |
|
|
| 409 | Email or username already exists |
|