Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

const express      = require('express');
const jwt          = require('jsonwebtoken');
const cookieParser = require('cookie-parser');
const crypto       = require('crypto');
const router       = express.Router();
router.use(cookieParser());

const ACCESS_SECRET  = process.env.ACCESS_SECRET  || 'access_secret';
const REFRESH_SECRET = process.env.REFRESH_SECRET || 'refresh_secret';

// In-memory refresh token store (use Redis/DB in production)
const refreshTokens = new Set();

function issueTokens(res, userId) {
    const accessToken = jwt.sign({ sub: userId }, ACCESS_SECRET, { expiresIn: '15m' });
    const refreshToken = crypto.randomBytes(40).toString('hex');
    refreshTokens.add(refreshToken);

res.cookie('refreshToken', refreshToken, {
        httpOnly: true, secure: true, sameSite: 'strict',
        maxAge: 7 * 24 * 60 * 60 * 1000,
    });
    return accessToken;
}

router.post('/login', (req, res) => {
    // Validate credentials (omitted for brevity)
    const accessToken = issueTokens(res, 1);
    res.json({ accessToken });
});

router.post('/refresh', (req, res) => {
    const { refreshToken } = req.cookies;
    if (!refreshToken || !refreshTokens.has(refreshToken)) {
        return res.status(401).json({ error: 'Invalid refresh token' });
    }
    refreshTokens.delete(refreshToken); // rotate
    const accessToken = issueTokens(res, 1);
    res.json({ accessToken });
});

router.post('/logout', (req, res) => {
    refreshTokens.delete(req.cookies.refreshToken);
    res.clearCookie('refreshToken');
    res.status(204).end();
});

module.exports = router;