|
2 | 2 |
|
3 | 3 | [](https://www.npmjs.com/package/@labdigital/federated-token)
|
4 | 4 |
|
5 |
| - |
6 | 5 | This package provides support for using JWT tokens for clients and passing
|
7 | 6 | that information to all federated services. The JWT token includes a JWE token
|
8 | 7 | for sensitive information like the client specific access tokens of third party
|
9 | 8 | systems.
|
10 | 9 |
|
11 | 10 | It provides three Apollo specific classes:
|
12 |
| - - `GatewayAuthPlugin` - An Apollo plugin for the GraphQL gateway that verifies |
13 |
| - the signature of the token passed and decrypts the embedded JWE property. It |
14 |
| - stores the verified and decrypted token on the context as `federatedToken`. |
15 | 11 |
|
16 |
| - - `FederatedGraphQLDataSource` - An Apollo GraphQL data source used in the |
17 |
| - GraphQL Gateway which passes the `federatedToken` from the context to the |
18 |
| - datasource (federated service) as `x-access-token` HTTP header. |
| 12 | +- `GatewayAuthPlugin` - An Apollo plugin for the GraphQL gateway that verifies |
| 13 | + the signature of the token passed and decrypts the embedded JWE property. It |
| 14 | + stores the verified and decrypted token on the context as `federatedToken`. |
| 15 | + |
| 16 | +- `FederatedGraphQLDataSource` - An Apollo GraphQL data source used in the |
| 17 | + GraphQL Gateway which passes the `federatedToken` from the context to the |
| 18 | + datasource (federated service) as `x-access-token` HTTP header. |
19 | 19 |
|
20 |
| - - `FederatedAuthPlugin` - An Apollo plugin for federated services that reads |
21 |
| - the token passed in the `x-access-token` header and stores it on the context |
22 |
| - as `federatedToken`. |
| 20 | +- `FederatedAuthPlugin` - An Apollo plugin for federated services that reads |
| 21 | + the token passed in the `x-access-token` header and stores it on the context |
| 22 | + as `federatedToken`. |
23 | 23 |
|
24 | 24 | When a federated services creates a new token (when non exist) it can also
|
25 | 25 | return a refresh token in the `x-refresh-token` header. The gateway will then
|
26 | 26 | encrypt all refresh tokens and encrypt them before passing them to the client
|
27 | 27 | as `x-refresh-token` header.
|
28 | 28 |
|
29 |
| - |
30 | 29 | # Token sources
|
| 30 | + |
31 | 31 | Public tokens can be passed via either HTTP headers or cookies. For browser
|
32 | 32 | clients cookies are the preferred way since these are easiest to store safely in
|
33 | 33 | the browser using a combination of HTTP_ONLY cookies and non-HTTP_ONLY cookies.
|
34 | 34 |
|
35 |
| - |
36 | 35 | ## Cookie Token Source
|
| 36 | + |
37 | 37 | This token source is used for browser clients to safely store the token. It is
|
38 | 38 | implemented via 4 cookies:
|
39 |
| - - `accessToken` - The JWT token |
40 |
| - - `tokenFingerprint` - A random string that is used to protect the AccessToken |
41 |
| - cookie from CSRF attacks. It is stored as HTTP_ONLY cookie. |
42 |
| - - `refreshToken` - The refresh token, if any. It is stored as HTTP_ONLY cookie. |
43 |
| - - `refreshTokenExists` - A boolean value that indicates if a refresh token |
44 |
| - exists for the user. It is used to determine if the user is new or not. |
| 39 | + |
| 40 | +- `accessToken` - The JWT token |
| 41 | +- `tokenFingerprint` - A random string that is used to protect the AccessToken |
| 42 | + cookie from CSRF attacks. It is stored as HTTP_ONLY cookie. |
| 43 | +- `refreshToken` - The refresh token, if any. It is stored as HTTP_ONLY cookie. |
| 44 | +- `refreshTokenExists` - A boolean value that indicates if a refresh token |
| 45 | + exists for the user. It is used to determine if the user is new or not. |
0 commit comments