Real world examples of jwt refreshing tokens

[leopucci]

Hi, thanks for your nice work so far.
I am struggling to find real world examples of modern code.
There are plenty of examples of old designed code, but not real world examples of this "rtk modern design" approach.

I already read the documentation and it just offers bits and pieces, there is no real world examples using modern design, just some pieces of auth.

I am using redux/axios/thunk to do using the old redux way with actions creators, reducers declared. but as I am building a new app, I am trying to use the new way of doing it and I am struggling with refreshing tokens.

Are there some complete login example, that the api code can handle the refresh tokens expiring, renewing, on this modern approach that you are aware of and could share with me?

Thanks
Pucci

[agusterodin]

RTKQ is great for many things data related but you may want to consider using a purpose-built auth library for auth. If you are using Next I highly recommend next-auth.

[leopucci]

Outsourcing security is not a thing that I like to do. Jwt tokens are a well stablished design that can be implemented in-company.

[agusterodin]

I guess it depends on the nature of your company (start-up, small business, government contract, company like google, etc). I'd say for 99% of startups and small businesses, auth is a fools chore. Auth is a hell of a lot of time/resources that can be devoted to delivering other value.

Auth0 and other authentication providers even have JS/React implementation libraries of their own. If you end up using their auth service, i'm sure you can trust the library they provide you.

[leopucci]

I agree with you. I had to develop by my own all the login proccess that I could outsource and check it out later, but I prefered to deal with this right away, and make the sw taylor maded without having to refactor later.

[agusterodin]

Also, please consider moving this thread to "discussions"

[msutkowski]

I guess it depends on the nature of your company (start-up, small business, government contract, company like google, etc). I'd say for 99% of startups and small businesses, auth is a fools chore. Auth is a hell of a lot of time/resources that can be devoted to delivering other value.

Auth0 and other authentication providers even have JS/React implementation libraries of their own. If you end up using their auth service, i'm sure you can trust the library they provide you.

The main problem there is accounting for their outages... so then you're paying off that tech debt with a caching layer, but everyone likes to suffer in different ways!

@leopucci There are examples of using RTK Query with both of things you mention in the docs + runnable examples in the repo as well. There are two variants of an auth example (albeit very basic), and there is a code example for handling refresh tokens in a baseQuery.

The reason you don't see fully working examples with things like auth0 is that the implementation can vary depending on your configuration - but conceptually, the code above gets you 95%+ of the way there.