Scribd
Upload
5 views4 pages

Auth Module API Documentation

The Auth Module API provides stateless JWT authentication using access and refresh tokens stored in secure HTTP-only cookies. It includes endpoints for user signup, login, session management, password changes, and password resets, all returning JSON responses. Security measures such as HttpOnly, Secure, and SameSite attributes are implemented to protect tokens from XSS and CSRF attacks.

Uploaded by

tharunofficialbubbl
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
5 views4 pages

Auth Module API Documentation

The Auth Module API provides stateless JWT authentication using access and refresh tokens stored in secure HTTP-only cookies. It includes endpoints for user signup, login, session management, password changes, and password resets, all returning JSON responses. Security measures such as HttpOnly, Secure, and SameSite attributes are implemented to protect tokens from XSS and CSRF attacks.

Uploaded by

tharunofficialbubbl
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Auth Module API Documentation

Base Path: /api/v1/auth

Authentication Model: Stateless JWT Authentication using Access and Refresh Tokens stored in
Secure HTTP-only Cookies.

All responses are JSON unless specified.

Token & Cookie Strategy

Access Token: Short-lived JWT (10–15 minutes). Used to authenticate API and WebSocket
requests.

Refresh Token: Long-lived token (7–30 days). Used to obtain new access tokens without re-login.

Storage Method: Tokens are stored in Secure, HTTP-only cookies to prevent XSS access and
enable automatic browser handling.

Cookies Set By Server

Set-Cookie: access_token=<jwt>; HttpOnly; Secure; SameSite=Lax; Path=/


Set-Cookie: refresh_token=<token>; HttpOnly; Secure; SameSite=Strict; Path=/api/v1/auth/refresh

HttpOnly prevents JavaScript access. Secure ensures HTTPS-only transmission. SameSite


mitigates CSRF risk.

1. User Signup

POST /api/v1/auth/signup

Creates a new user account and logs the user in.

Request Body

{
"email": "user@[Link]",
"password": "PlainTextPassword"
}

Response — 201 Created

{
"user": {
"id": "ulid",
"email": "user@[Link]",
"createdAt": "ISO8601"
}
}

2. User Login

POST /api/v1/auth/login

Authenticates user credentials and issues auth cookies.

Request Body

{
"email": "user@[Link]",
"password": "PlainTextPassword"
}

Response — 200 OK

{
"user": {
"id": "ulid",
"email": "user@[Link]"
}
}

3. Refresh Access Token

POST /api/v1/auth/refresh

Issues a new access token using a valid refresh token. Refresh token is rotated.

Response — 200 OK

{
"refreshed": true
}

4. Logout

POST /api/v1/auth/logout

Invalidates refresh token and clears authentication cookies.


Response — 204 No Content

5. Get Current Session

GET /api/v1/auth/session

Returns currently authenticated user session details.

Response — 200 OK

{
"user": {
"id": "ulid",
"email": "user@[Link]"
},
"authenticated": true
}

6. Change Password

POST /api/v1/auth/change-password

Allows authenticated users to update their password.

Request Body

{
"currentPassword": "OldPassword",
"newPassword": "NewPassword"
}

Response — 204 No Content

7. Request Password Reset

POST /api/v1/auth/forgot-password

Sends password reset link to user email.

Request Body

{
"email": "user@[Link]"
}
Response — 204 No Content

8. Reset Password

POST /api/v1/auth/reset-password

Resets password using secure reset token.

Request Body

{
"token": "reset_token",
"newPassword": "NewPassword"
}

Response — 204 No Content

You might also like