6389dcf78e
Backend: - Auth controller sets httpOnly secure cookies (access_token, refresh_token, goodgo_authenticated) on login/register/refresh - JWT strategy reads token from cookie first, falls back to Authorization header - Added POST /auth/logout to clear auth cookies - Added POST /auth/exchange-token for OAuth callback token-to-cookie exchange - Refresh endpoint reads refresh_token from cookie (body fallback for backwards compat) - CSRF middleware excludes auth endpoints (login, register, refresh, exchange-token, logout) Frontend: - Removed all localStorage token storage (goodgo_tokens key) - Removed authGet/authPost/authPatch helpers from api-client (tokens sent via cookies) - All API calls use credentials:'include' for cookie-based auth - Updated auth-store: no more token state, uses isAuthenticated flag from cookie - Updated admin-api, listings-api to remove explicit token parameters - Updated all pages (admin dashboard, users, KYC, moderation, listings) to remove token passing - OAuth callbacks use exchange-token endpoint to convert URL tokens to cookies - Auth provider simplified (no client-side cookie management needed) Security improvements: - JWT no longer accessible via JavaScript (XSS-safe) - Refresh token scoped to /auth path only - Server-side goodgo_authenticated cookie with SameSite=Lax - Access token cookie with SameSite=Strict Co-Authored-By: Paperclip <noreply@paperclip.ing>
56 lines
1.6 KiB
TypeScript
56 lines
1.6 KiB
TypeScript
'use client';
|
|
|
|
import { useEffect, useRef } from 'react';
|
|
import { useRouter, useSearchParams } from 'next/navigation';
|
|
import { Loader2 } from 'lucide-react';
|
|
import { useAuthStore } from '@/lib/auth-store';
|
|
|
|
export default function GoogleCallbackPage() {
|
|
const router = useRouter();
|
|
const searchParams = useSearchParams();
|
|
const { handleOAuthCallback } = useAuthStore();
|
|
const processed = useRef(false);
|
|
|
|
useEffect(() => {
|
|
if (processed.current) return;
|
|
processed.current = true;
|
|
|
|
const accessToken = searchParams.get('accessToken');
|
|
const refreshToken = searchParams.get('refreshToken');
|
|
const expiresIn = searchParams.get('expiresIn');
|
|
const error = searchParams.get('error');
|
|
|
|
if (error) {
|
|
router.replace(`/login?error=${encodeURIComponent(error)}`);
|
|
return;
|
|
}
|
|
|
|
if (!accessToken || !refreshToken) {
|
|
router.replace('/login?error=oauth_failed');
|
|
return;
|
|
}
|
|
|
|
handleOAuthCallback(
|
|
accessToken,
|
|
refreshToken,
|
|
expiresIn ? Number(expiresIn) : 900,
|
|
)
|
|
.then(() => {
|
|
const redirect = searchParams.get('redirect') || '/dashboard';
|
|
router.replace(redirect);
|
|
})
|
|
.catch(() => {
|
|
router.replace('/login?error=oauth_failed');
|
|
});
|
|
}, [searchParams, handleOAuthCallback, router]);
|
|
|
|
return (
|
|
<div className="flex min-h-screen items-center justify-center">
|
|
<div className="text-center">
|
|
<Loader2 className="mx-auto h-8 w-8 animate-spin text-primary" />
|
|
<p className="mt-4 text-sm text-muted-foreground">Đang xử lý đăng nhập Google...</p>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|