如何在Nestjs刷新会话cookie
我已经成功实施了Nestjs的会话身份验证。我一直使用JWT并非常迅速地到期。要获得新的访问令牌，前端将需要刷新访问令牌。
我正在尝试使用Nestjs Session Authentication实施与此类似的内容，但我没有任何了解如何继续进行的线索，因为我找不到任何有关如何执行此操作的资源。
我不介意您是否建议您进行视频或文章来解释这一点，或者只是解释我应该如何继续进行此操作。还是我什至需要为刷新而烦恼吗？如果有人可以访问会话cookie怎么办？我需要澄清！
I have successfully implemented session authentication with NestJS. I have always used JWT and expire the access token very quickly. To get a new access token the frontend will need to refresh the access token.
I am trying to implement something similar to this with NestJS Session Authentication and I don't have a clue on how to go ahead with it as I couldn't find any resources talking about how to do this.
I wouldn't mind if you recommend a video or an article explaining this or just explaining how I should go ahead with this. Or do I even need to bother about refreshing?? What if someone had access to the session cookie?? I need clarification, please!!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我在Nestjs面临着同样的挑战。因此，根据我的经验，我推荐您阅读官方的Nestjs -Cookies文档，以确保您在此框架上使用最佳方法：
nestjs- cookie
为了进一步学习和深度潜水，您应该检查此答案以解决此cookie实现此框架： Nestjs如何在请求中获得cookie？ /a>
，最后但并非最不重要的一点是，这是一篇非常有用的文章，同时使用cookie和JWT组件，因此我认为您可能想阅读它，看看是否适合您的需求：
“ nofollow noreferrer”> nest.js cookie基于jwt authentication
关于“令人振奋的”过程您想使用cookie更新/刷新JWT令牌，因此您需要实现一个中间件类来验证“到期”或“ max-age”属性，以检查cookie是否已过期，然后您可以实现所需的东西。
请记住，Cookie，需要在饼干本身中设置几个木制，以使其安全地免受中间人的攻击，甚至可以使饼干被盗。
I was facing the same challange on NestJS. So, according to my experience on this I recomend you to read the official NestJS - Cookies documentation just to ensure that you're using the best approach on this framework:
NestJS - Cookies
For further learning and deep diving you should check on this answer hot to tackle this cookie implementation on this framework: How does nestjs get the cookie in the request?
And last but not least, this is a really useful post that uses both cookies and JWT components so I think you might want to read it and see if fits your needs:
Nest.js cookie based JWT authentication
Regarding the "refreshing" process I asume you want to update/refresh the JWT token using the cookie so you will need to implement a middleware class that validates the "Expires" or "Max-age" attributes in order to check if the cookie has expired and then you'd be able to implement what you need.
Remember that cookies, have several attirbutes that you need to set in the cookie itself to make it secure against men-in-the-middle attacks or even get your cookie stolen.