Comparing
#2 with
#4
Content
[...]
- Add the authenticator behavior to your controllers
- For `AuthController.php` we must exclude actions that do not require being authenticated, like `login`, `refresh-token`, `options` (when browser sends the cross-site OPTIONS request).
```php
public function behaviors() {
$behaviors = parent::behaviors();
$behaviors['authenticator'] = [
'class' => \sizeg\jwt\JwtHttpBearerAuth::class,
'except' => [[...]
'urf_created' => gmdate('Y-m-d H:i:s'),
]);
if (!$userRefreshToken->save()
;) {
throw new \yii\web\ServerErrorHttpException('Failed to save the refresh token: '. $userRefreshToken->getErrorSummary(true));
}
// Send the refresh-token to the user in a HttpOnly cookie that Javascript can never read and that's limited by path
Yii::$app->response->cookies->add(new \yii\web\Cookie([
'name' => 'refresh-token',
'value' => $refreshToken,[...]
34k+
