JWT Refresh token and Multi-Page Application

Question

I am going to implement JWT authentication for several independent services. There will be auth.example.com and service1.example.com, service2.example.com etc.

My assumptions:

• JWT can be kept in cookie for ".example.com"
• JWT expire time should be small (like 15 mins) because there is no reliable way to logout user with JWT token (revoke token).
• Refresh tokens should be used to reissue JWT tokens
• Refresh token cookies should be accessible only by auth.example.com for security reasons and because https://tools.ietf.org/html/rfc6749#section-1.5 says "Unlike access tokens, refresh tokens are intended for use only with authorization servers and are never sent to resource servers."

Next, if I have a service - multi page application (i.e. not SPA), where some URLs are called "traditional" way, not via Ajax and render HTML based on some server side logic, which, of course, include checking of user authorization.

then, say, there will be an action service1.example.com/user/showpage

if (user.logged_in) {
  render_some_html(get_some_data(user.login))
}
else {
  render_anonimous_uses_page()
}

Problem is:

If site user close all site tabs and, then after hour or so, go directly to page /user/showpage (or maybe he suspend laptop and wake it up in an hour and go to that page).

What if by that time JWT token will expire. Then to refresh it by Refresh token we need to make Ajax call to auth.example.com (because Refresh token is stored only in auth.example.com cookie) and this is just unaccessible in server side rendering (that pseudocode that I posted above, it's server side, and it's just impossible to make client ajax call in the middle of execution of server code. it's just not applicable here). This way user will be considered logged out on this stage.

Redirect could be one solution.. but what if site should work for anonymous out users too, and anyway looking for something better.

SPA 应用不存在这个问题，因为在每次 Ajax 调用内部 API 之前，它可以检查 JWT 并调用刷新 JWT 令牌。

问题是：由于这个问题，JWT 通常不应该（不能）用于多页（传统）应用程序，这是真的吗？或者有什么好方法可以解决这个问题？或者这根本不是问题（用户不会经常关闭标签，或者他们希望站点将它们注销或重定向等）？

Answer 1

我已经使用ServiceWorkers在多页面项目中实现了基于令牌的身份验证。

使用 ServiceWorker，您将能够创建一个 fetch 事件处理程序，前端发送的每个请求都会调用该事件处理程序。在此处理程序中，您可以重定向、发送请求、添加身份验证标头和存储令牌。在注册 ServiceWorker 后，此获取处理程序将在每次请求时执行。即使在页面加载时也是如此。

我是这样配置的。
对于每个请求，处理程序都会：

• 检查访问令牌是否有效（检查过期）。
• 如果令牌无效：调用/auth/refresh.
• 将访问令牌添加到身份验证标头。
• 将更新后的请求发送到后端。

我还对何时必须登录和注销进行了一些额外的检查。
在登录请求时，处理程序将：

• 从 ServiceWorker 调用登录 URL。
• 从登录响应中获取访问令牌。
• 将登录响应返回给前端。

在注销请求时，处理程序将：

• 从浏览器存储中删除访问令牌。
• 将更新后的请求发送到后端。

这是我的 Astro 项目的 ServiceWorker。