indexdata / foliojs Goto Github PK

See https://issues.folio.org/browse/FOLIO-3627

In summary:

• Login at authn/login-with-expiry instead of authn/login
• Send Credentials: include in each FOLIO fetch request
• Do not send X-Okapi-Token headers (we will not have a token)
• Invoke authn/refresh to get new tokens when a request fails with 403.

See more in the A brief guide for implementing RTR for clients section of the Refresh Token Rotation (RTR) document.

@dcrossleyau writes:

Is it possible to still set the this.token when doing new style login? I use this library to make a simple login script which exports an environment variable. I then use that token environment variable to follow-up with a couple of 'httpie' or 'curl' command-line api calls. Crude, i know, but effective.

Should be easy enougj to do by poking through the headers, even though the tokens do not appear in the response body.

FOLIO is transitioning from old-style token-bases authentication to new-style cookie-based authentication with session expiry. The FolioJS library implements both, favouring the new style when the back-end support it.

We should have a way for client code to request that old-style authentication is used. This might be an extra parameter to the session.login method (and a corresponding extra parameter to the service.login method). Or perhaps an environment variables would be better.

@dcrossleyau @wafschneider @funkymalc @ihardy Which would be more useful for you?

At present, re-authentication happens when half of the session's TTL has expired — which means every five minutes, since FOLIO is hardwired to expire tokens after ten minutes.

That's usually fine, but when developing and testing (e.g. to work on okapi-auth-proxy) it's sometimes convenient to have a much shorter timeout.

We should introduce an environment variable for overriding this default.