GraphQL backend — token expiry
Tags: graphql, springboot
Published: 2021-06-01 18:23:08

---
## Common
title: GraphQL backend — token expiry
tags: [graphql, springboot]
description: GraphQL authorization — token expiry
published: true

## Github pages
layout: post
image: /assets/covers/gql_401.jpg
sitemap: false
hide_last_modified: false
no_break_layout: false

## Dev.to
cover_image: https://mahendranv.github.io/assets/covers/gql_401.jpg
canonical_url: https://mahendranv.github.io/posts/gql-auth-401/
series: GraphQL backend

---
In the [previous post](https://mahendranv.github.io/posts/gql-auth/) we covered authentication and role management. However, it assumed any invalid session to be a visitor instead of throwing 401—Unauthorized client error. This post covers the token expiry aspect of API call.

Let's start with coding part. Following block diagram explains the interaction between each component. As usual, we'll build the system bottom-up.

![](https://mahendranv.github.io/assets/img/2021-06-01-23-21-29.png)


 <ul>
 <li><a href="#token-service" id="markdown-toc--token-service">🎟 Token Service</a></li> 
 <li><a href="#token-expiry-strategy" id="markdown-toc--token-expiry-strategy">⏲ Token Expiry Strategy</a></li> 
 <li><a href="#request-manager" id="markdown-toc--request-manager">👮 Request Manager</a></li> 
 <li><a href="#more-on-error-handling" id="markdown-toc--more-on-error-handling">🐞 More on error handling</a></li> 
 <li><a href="#resources" id="markdown-toc--resources">📖 Resources</a></li> 
 </ul>

## 🎟 Token Service

To manage session and expire it, we need meta attributes other than just the token. So, let's beef up the token to a data class called SessionToken. This will hold created & last access timestamps in addition to the token itself.

```kotlin

data class SessionToken(
    val token: String,
    val created: OffsetDateTime,
    var lastAccess: OffsetDateTime = created
)

```

Our token service is a simple repository which abstracts CRUD on token. When user login-register, a new token generated and wrapped in `SessionToken`. For every web request made, the token updated with last access time. In case user logout or token expired, entry will be deleted. 

Below is our simple implementation — we store our mock tokens as usual to keep our focus on expiry. The created time points to `now()` i.e we emulate like user logged in at the time of launch.

```kotlin

@Service
class TokenService {

    private val store = mutableMapOf<String, SessionToken>()

    init {
        store["token-buyer"] =
            SessionToken("token-buyer", OffsetDateTime.now())
        store["token-seller"] =
            SessionToken("token-seller", OffsetDateTime.now())
    }

    fun createToken() = SessionToken(
        token = UUID.randomUUID().toString(),
        created = OffsetDateTime.now()
    )

    fun peekToken(token: String?): SessionToken? = store[token]

    fun updateLastAccessTime(token: String) {
        // TODO: Token not found in store - fishy!!
        store[token]?.lastAccess = OffsetDateTime.now()
    }

    fun deleteToken(token: String?) {
        store.remove(token)
    }
}

```

## ⏲ Token Expiry Strategy

When it comes to expiry, it's always a good practice to abstract out the validation part and create functional interface to carry out the validation. This will help us plug-in different implementations in the system with little config change. 

This brings us to a functional interface `SessionExpiryStrategy` which takes a `SessionToken` validate and return whether it is expired.

```kotlin

interface SessionExpiryStrategy {

    fun isSessionExpired(token: SessionToken): Boolean

}

```

An implementation is only good when explained with its implementations. We consider three different strategies for this.
1. Fixed lifespan : Session will expire after 30 days
2. Timeout : If user is not active for 3 minutes — logout
3. Extended Lifespan: If user is active during the 30th day, give him grace period in 3 minute window

```kotlin
@Component("fixed_time")
class FixedLifeSpanStrategy : SessionExpiryStrategy {
    // 30 days fixed lifespan
    val MAX_DURATION = 30 * 24 * 60 * 60
    override fun isSessionExpired(token: SessionToken): Boolean {
        val durationSinceLogin = ChronoUnit.SECONDS.between(
            token.created,
            OffsetDateTime.now()
        )
        return durationSinceLogin > MAX_DURATION
    }
}
```

```kotlin
@Component("timeout")
class TimeoutExpiryStrategy : SessionExpiryStrategy {
    // Logout after 3 minutes of inactivity
    const val MAX_DURATION = 3 * 60
    override fun isSessionExpired(token: SessionToken): Boolean {
        val durationSinceLastAccess = ChronoUnit.SECONDS.between(
            token.lastAccess,
            OffsetDateTime.now()
        )
        return durationSinceLastAccess > MAX_DURATION
    }
}
```

```kotlin
@Component("extended")
class ExtendedLifeSpanStrategy : SessionExpiryStrategy {
    private val timeoutExpiryStrategy = TimeoutExpiryStrategy()
    private val fixedLifeSpanStrategy = FixedLifeSpanStrategy()
    override fun isSessionExpired(token: SessionToken): Boolean {
        return if (fixedLifeSpanStrategy.isSessionExpired(token)) {
            // 30 days past, if user is in the mid of something try the timeout
            // to extend his session
            timeoutExpiryStrategy.isSessionExpired(token)
        } else {
            // 30 days not past yet Let him use the system
            false
        }
    }
}
```

**Few Usecases:**
As you can see in `ExtendedLifeSpanStrategy`, we can mix-match the implementations to tailor user experience. Let's say the buyer in our e-commerce website actively purchasing something and just before he makes payment, session expire due to 30 day lifespan — It would be frustrating. Three minutes added on each api call will alleviate the expiry.

If we want Seller account to logout on 3 minutes inactivity and a fixed timespan for Buyer, it can be achieved by picking strategy 'per role'. 

```kotlin

val strategies = mapOf(
    BUYER to fixedTimeSpan,
    SELLER to timeoutStrategy
)

...

strategy[role].isSessionExpired(token)

```

We have a strategy and a tokenservice in place — let's move on to the final piece where we connect both.

## 👮 Request Manager

Before we move on to the logic, let's fix the 🐞 in user service. From now, it will return `null` role for unknown/expired tokens. Still, if there is no token present, session will be identified as VISITOR.

```kotlin

    fun identifyRole(token: String?): Roles? {
        return if (token == null)
            Roles.VISITOR
        else
            role[token]
    }

```

In the request manager, wire the expiry strategy as you see fit. We'll use qualifiers to inject different strategies that we implemented in last section.

```kotlin

    @Autowired
    @Qualifier("timeout")
//    @Qualifier("extended")
//    @Qualifier("fixed_time")
    private lateinit var tokenExpiryStrategy: SessionExpiryStrategy

     // Save the session info per request. Retrieve it throughout the request
    fun saveSession(request: HttpServletRequest) {
        // Retrieve auth token from request - if any
        val token: String? = request.getHeader(HEADER_TOKEN)

        // Identify role
        val role = userService.identifyRole(token)
        if (role == null) {
            broadcastTokenWipe(token)
            throw unauthorizedException()
        }

        // Handling users that need a session
        if (role != Roles.VISITOR) {
            val sessionToken = tokenService.peekToken(token)
            if (sessionToken == null || tokenExpiryStrategy.isSessionExpired(sessionToken)) {
                broadcastTokenWipe(token)
                throw unauthorizedException()
            }

            // punch-in to the token service
            tokenService.updateLastAccessTime(token!!)
        }

        request.setAttribute(
            KEY_SESSION, DummySession(
                role = role
            )
        )
    }

```

Added inline comments for clarity, again a walkthrough here. If role is null, throw exception. If session token is null or expired for non-VISITORs throw exception. In both cases wipe the token off the system. 

So, what do we throw? — 401 response.

```kotlin
   private fun unauthorizedException() = HttpClientErrorException.create(
        HttpStatus.UNAUTHORIZED,
        "",
        HttpHeaders.EMPTY,
        ByteArray(0),
        Charsets.UTF_8
    )
```

If the session is valid, update the last access time in token service to support `TimeoutStrategy`. 

## 🐞 More on error handling

In case, the session is timeout, don't let the request proceed further to protect resources. i.e break the chain in request filter.

```kotlin

@Component
class DummyRequestFilter : OncePerRequestFilter() {

    @Autowired
    private lateinit var requestManager: DummyRequestManager

    override fun doFilterInternal(
        request: HttpServletRequest,
        response: HttpServletResponse,
        filterChain: FilterChain
    ) {
        try {
            // Feed the request to request manager for session preparation
            requestManager.saveSession(request)

            // Resume with request
            filterChain.doFilter(request, response)
        } catch (e: HttpClientErrorException) {
            response.sendError(e.rawStatusCode, e.statusText)
        }
    }
}

```

In dummy request filter, once per request check whether the token is valid. If so, resume the chain, otherwise catch and propogate the 401 error code to the client. 

🐛 That's it 🐛 

---

## 🚀 Run it!

```json
curl 'http://localhost:8080/graphql' \
  -H 'x-auth-token: token-random-one' \
  -H 'Content-Type: application/json' \
  --data-raw '{"query":"mutation {addProduct}","variables":null}' \
  --compressed

{"timestamp":"2021-06-01T18:28:55.325+00:00","status":401,"error":"Unauthorized","path":"/graphql"}

curl 'http://localhost:8080/graphql' \
  -H 'x-auth-token: token-seller' \ 
  -H 'Content-Type: application/json' \
  --data-raw '{"query":"mutation {addProduct}","variables":null}' \
  --compressed

{"data":{"addProduct":"dummy-product-id"}}

```

---


## 📖 Resources

1. [Github repo](https://github.com/mahendranv/graphql-auth-dummy)
2. GraphQL playground — http://localhost:8080/graphiql