Files
CFDivePlatform/frontend/src/api/axios.js
T
a620906209 d9f0fe11c6 security(auth): P1 Token Refresh + sessionStorage
- 新增三個 refresh 端點(member/provider/admin),revoke 舊 token 發行新 7 天 token
- axios.js / coachAxios.js:401 interceptor 改為 refresh-then-retry,含 isRefreshing queue 防並發、isRedirecting flag 防雙重 redirect
- auth.js / coachAuth.js / AuthCallbackView.vue:localStorage 全改為 sessionStorage
- echo.js / notificationAxios.js:同步改為 sessionStorage
- notifications.js:401 時停止 polling(stopPolling),不印 error log
- 新增 TokenRefreshTest.php(11 tests / 24 assertions):refresh 成功/失效/跨角色 403

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-02 04:33:35 +08:00

82 lines
2.0 KiB
JavaScript

import axios from 'axios'
const api = axios.create({
baseURL: import.meta.env.VITE_API_URL + '/api',
headers: { Accept: 'application/json' },
})
api.interceptors.request.use((config) => {
const token = sessionStorage.getItem('token')
if (token) {
config.headers.Authorization = `Bearer ${token}`
}
return config
})
let isRefreshing = false
let isRedirecting = false
let pendingRequests = []
function resolvePending(token) {
pendingRequests.forEach((cb) => cb(token))
pendingRequests = []
}
function rejectPending(error) {
pendingRequests.forEach((cb) => cb(null, error))
pendingRequests = []
}
api.interceptors.response.use(
(response) => response,
async (error) => {
const config = error.config
const status = error.response?.status
const isAuthEndpoint =
config.url.includes('/login') ||
config.url.includes('/register') ||
config.url.includes('/refresh')
if (status !== 401 || isAuthEndpoint || config._retry) {
return Promise.reject(error)
}
if (isRefreshing) {
return new Promise((resolve, reject) => {
pendingRequests.push((token, err) => {
if (err) return reject(err)
config.headers.Authorization = `Bearer ${token}`
resolve(api(config))
})
})
}
config._retry = true
isRefreshing = true
try {
const { data } = await api.post('/member/refresh')
const newToken = data.data.token
sessionStorage.setItem('token', newToken)
api.defaults.headers.common['Authorization'] = `Bearer ${newToken}`
resolvePending(newToken)
config.headers.Authorization = `Bearer ${newToken}`
return api(config)
} catch {
rejectPending(error)
if (!isRedirecting) {
isRedirecting = true
sessionStorage.removeItem('token')
sessionStorage.removeItem('user')
window.location.href = '/login'
}
return Promise.reject(error)
} finally {
isRefreshing = false
}
}
)
export default api