File manager - Edit - /home/webapp69.cm.in.th/u69319090038/Shop/api/auth/refresh.php
Back
<?php // POST /api/auth/refresh.php — Silent token rotation require_once __DIR__ . '/../init.php'; if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405); $refreshToken = $_COOKIE['refreshToken'] ?? ''; if (!$refreshToken) Response::unauthorized('No refresh token. Please login again.', 'NO_REFRESH'); $db = DB::conn(); // ─── Validate refresh token ─────────────────────────────── try { $payload = JWT::decode($refreshToken, JWT_REFRESH_SECRET); } catch (RuntimeException $e) { clearRefreshCookie(); $stmt = $db->prepare('DELETE FROM user_sessions WHERE refresh_token = ?'); $stmt->execute([$refreshToken]); Response::unauthorized('Refresh token expired or invalid. Please login again.', 'REFRESH_INVALID'); } // ─── Check session still valid in DB ───────────────────── $stmt = $db->prepare( 'SELECT * FROM user_sessions WHERE refresh_token = ? AND expires_at > NOW() LIMIT 1' ); $stmt->execute([$refreshToken]); $session = $stmt->fetch(); if (!$session) { clearRefreshCookie(); Response::unauthorized('Session expired. Please login again.', 'SESSION_EXPIRED'); } // ─── Fetch user ─────────────────────────────────────────── $stmt = $db->prepare('SELECT id, username, email, role, avatar_url FROM users WHERE id = ? AND is_active = 1'); $stmt->execute([$payload['id']]); $user = $stmt->fetch(); if (!$user) { clearRefreshCookie(); Response::unauthorized('User not found.', 'USER_NOT_FOUND'); } // ─── Issue new access token ─────────────────────────────── $newAccessToken = buildAccessToken($user); Response::success('Token refreshed.', [ 'accessToken' => $newAccessToken, 'user' => [ 'id' => (int)$user['id'], 'username' => $user['username'], 'email' => $user['email'], 'role' => $user['role'], 'avatar_url' => $user['avatar_url'], ], ]);
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.25 |
proxy
|
phpinfo
|
Settings