john-okeefe
8a6ea39ed2
- Add comprehensive authentication overview.md explaining: - 7-day session duration for JWT and refresh tokens - Constants-based implementation (no hardcoded values) - Complete authentication flow (register/login/refresh/logout) - Session expiration handling (HTML redirect vs JSON error) - Security features (HTTP-only cookies, token rotation) - Token storage recommendations - Update login.md with 7-day expires_in field and cookie MaxAge - Update register.md with 7-day session duration details - Update refresh_token.md with expires_in: 604800 Documentation provides complete reference for authentication endpoints with examples and security considerations.
43 lines
826 B
Markdown
43 lines
826 B
Markdown
# Refresh Token
|
|
|
|
Obtain a new JWT access token using a refresh token.
|
|
|
|
**Endpoint**: `POST /api/auth/refresh`
|
|
**Auth**: Not required (uses refresh token)
|
|
**Content-Type**: `application/json`
|
|
|
|
## Request Body
|
|
|
|
| Field | Type | Required | Description |
|
|
|--------|------|-----------|-------------|
|
|
| refresh_token | string | Yes | Valid refresh token (UUID) |
|
|
|
|
### Example Request
|
|
|
|
```json
|
|
{
|
|
"refresh_token": "d4f5g6h7..."
|
|
}
|
|
```
|
|
|
|
## Response (200 OK)
|
|
|
|
```json
|
|
{
|
|
"access_token": "new-jwt-token",
|
|
"token_type": "Bearer",
|
|
"expires_in": 604800
|
|
}
|
|
```
|
|
|
|
**Session Duration**: 7 days (604800 seconds)
|
|
|
|
The new access token is valid for 7 days from the time of refresh.
|
|
|
|
## Error Responses
|
|
|
|
| Code | Description |
|
|
|------|-------------|
|
|
| 401 | Invalid or expired refresh token |
|
|
| 400 | Missing refresh token or invalid format |
|