---
# System prepended metadata

title: Authentification Protocol

---

# Authentification Protocol

With every login, either Oauth or LocalLogin, the server sends both an refresh-token and an access-token.

# Access-Token

As access-token we are using an jwt token
The access-token is send in the body of the response of the successfull login and also as cookie. 

The acces-token is by default valid for one hour, which can be configured via environment variables

## Structure

The token itself contains the following attributes:

| Identifier       | Type      | Description                                                                                                                                                              |
|------------------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| sub              | UUID      | The uuid of the user that this access-token belongs to                                                                                                                   |
| email            | String    | Primary email of the user                                                                                                                                                |
| type             | TokenType | As of now, only CLIENT is acceptable but can later be set to Server or System or something else to allow for some  sort of API-Access by other software or microservices |
| accountConfirmed | Boolean   | Wheater or not the account/email of that user is already confirmed or not                                                                                                |
| iat              | number    | Time the token was issued at                                                                                                                                             |
| exp              | number    | Time when the token expires                                                                                                                                              |
| aud              | String    | the url that token got created for                                                                                                                                       |
| iss              | String    | the name of the server, that issued the token to the user                                                                                                                |

## Example

**a valid access - token:**

>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJiY2IzYjg5Yi1kOTMxLTRhNzEtOGE1MC1kMTJjNTM0ODZmYWUiLCJlbWFpbCI6InRlc3RlckBoYWxsby5jb20iLCJ0eXBlIjoiQ0xJRU5UIiwiYWNjb3VudENvbmZpcm1lZCI6ZmFsc2UsImlhdCI6MTYxMzIyOTY0NiwiZXhwIjoxNjEzMjMzMjQ2LCJhdWQiOiJodHRwczovL2xvY2FsaG9zdCIsImlzcyI6InNhdmVkYXRlLWRldmVsb3BtZW50In0.foxzFLIU9Ndof9buRgZPtH31HGNPcO2Bi-j06M6NF5w

**decrypts to:**

```json
{
  "sub": "bcb3b89b-d931-4a71-8a50-d12c53486fae",
  "email": "tester@hallo.com",
  "type": "CLIENT",
  "accountConfirmed": false,
  "iat": 1613229646,
  "exp": 1613233246,
  "aud": "https://localhost",
  "iss": "savedate-development"
}
```

# Refresh Token

The refresh token is a random string (without any meaning) that will be created and send with every successfull login attempt. It will also be stored in a database / cache  so that the server can check its validity.

```ts
  id: string;

  userId: string;

  token: string;

  createdAt: string;

  updatedAt: string;

  lastUsedAt: string;

  userAgent: string;

  location: string;

  ipAddress: string;

```

### Web
The access token is handled by the browser (as HTTP-ONLY cookie). 
There is an authentication interceptor present (auth-interceptor.ts) that waits for 
denied access token responses from the server. 
With the refresh token the client can perform a GET request to the auth/refresh/accessToken endpoint that will send 
a new access token if the refresh token is valid.

