hamed
194ffd889c
- Added isomorphic-dompurify for improved XSS protection - Refactored token storage to use in-memory management for access tokens - Implemented server-side route handlers for OAuth token management - Introduced security headers in next.config.js - Removed client-side exposure of client_secret and sensitive tokens - Updated API interceptors to handle token refresh logic - Cleaned up cookie management for refresh tokens
26 lines
814 B
JavaScript
26 lines
814 B
JavaScript
import { NextResponse } from "next/server";
|
|
import { axiosInstance } from "@/lib/req";
|
|
import { clearRefreshCookie, COOKIE_NAME } from "@/lib/refreshCookie";
|
|
|
|
export async function POST(request) {
|
|
const API_URL = process.env.NEXT_PUBLIC_API_URL;
|
|
const host = request.headers.get("host");
|
|
const refreshToken = request.cookies.get(COOKIE_NAME)?.value;
|
|
|
|
if (refreshToken) {
|
|
try {
|
|
await axiosInstance.post(
|
|
`${API_URL}/oauth/logout`,
|
|
{ refresh_token: refreshToken },
|
|
{ headers: { "Content-Type": "application/json", Authorization: "" } }
|
|
);
|
|
} catch {
|
|
// revoke best-effort; clearing the cookie below is what matters
|
|
}
|
|
}
|
|
|
|
const response = NextResponse.json({ success: true }, { status: 200 });
|
|
clearRefreshCookie(response, host);
|
|
return response;
|
|
}
|