Blog

Luis Majano

September 02, 2021

Spread the word


Share your thoughts

We are incredibly excited to release cbSecurity version 2.13.0 today. This release packs a big punch in terms of features for our JWT support for RESTFul APIs. We are excited to announce full refresh token support and much more.

# Install
install cbsecurity

# Update
update cbsecurity

Refresh Tokens

ColdBox Security supports the concept of refresh tokens alongside the normal JWT access tokens.

What Is a Refresh Token?

A refresh token is a credential artifact that lets a client application get new access tokens without having to ask the user to log in again. Access tokens may be valid for a short amount of time. Once they expire, client applications can use a refresh token to "refresh" the access token.

The client application can get a new access token as long as the refresh token is valid and unexpired. Consequently, a refresh token that has a very long lifespan could theoretically give infinite power to the token bearer to get a new access token to access protected resources anytime. The bearer of the refresh token could be a legitimate user or a malicious user.

You can read all about how we implemented refresh tokens for ColdBox security here: https://coldbox-security.ortusbooks.com/jwt/refresh-tokens

What's New With 2.13.0

Added

  • Adobe 2021 Support
  • Migration to GitHub Actions from Travis CI
  • Refresh tokens support
  • Refresh token endpoint /cbsecurity/refreshToken for secure refresh token generation
  • Manual refresh token method on the JwtService : refreshToken( token )
  • Auto refresh token header interceptions for JWT validators
  • Detect on authenticate() if the payload is empty and throw the appropriate exceptions
  • Added ability for the authenticate( payload ) to receive a payload to authenticate
  • Added ability to recreate the token storage using a force argument getTokenStorage( force = false )
  • Ability for the parseToken() to choose to store and authenticate or just parse

Fixed

  • Unique jti could have collisions if tokens created at the same time, add randomness to it
  • TokenExpirationException not relayed from the base jwt library
  • If variables.settings.jwt.tokenStorage.enabled is disabled all invalidations failed, make sure if the storage is disabled to not throw storage exceptions.

Add Your Comment

Recent Entries

Ortus Content Digest for week of August 5th

Ortus Content Digest for week of August 5th

It's August 5th... what has Ortus been publishing this week? We have the CFML News Podcast, some CFCasts and YouTube Videos, lots of Ortus and ITB Blog Posts. We have a lot more planned for next week as well.

Gavin Pickin
Gavin Pickin
August 05, 2022
Integrating ColdBox with Existing Code Series Part 4: More Integration

Integrating ColdBox with Existing Code Series Part 4: More Integration

Recently I did a webinar on Refactoring Legacy Code and the question came up about whether or not it was possible to use Coldbox with existing code without converting everything to a Coldbox module or making changes to the existing codebase. In the first installation in this series, we took a tour of the various elements which make up ColdBox. In the second installation, we looked at creating layouts, views, and routes in the main site. In this installation, we’re going to start incorporating our existing code base and do so using a module.

Dan Card
Dan Card
August 03, 2022
ColdBox 6.8.0 Released

ColdBox 6.8.0 Released

 

I am incredibly excited to announce the release of ColdBox v6.8.0 and its standalone companion libraries: CacheBox, LogBox and WireBox. This update includes some important fixes and we managed to squeeze some nice improvements!

Luis Majano
Luis Majano
August 01, 2022