From d7fc68d721d418053deba8ab17dff845413735d9 Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Tue, 22 May 2018 00:03:03 -0500
Subject: [PATCH] fix to many jwt refreshes

---
 app/rest/auth/auth.go | 12 ++++++------
 app/rest/auth/jwt.go  |  7 +++----
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go
index aac4594a..05e559f2 100644
--- a/app/rest/auth/auth.go
+++ b/app/rest/auth/auth.go
@@ -48,7 +48,7 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 				return
 			}
 
-			if err != nil { // in anonymous mode just pass it to next handler
+			if err != nil { // in anonymous mode just pass it to the next handler
 				h.ServeHTTP(w, r)
 				return
 			}
@@ -58,18 +58,18 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 				return
 			}
 
-			if claims.User != nil { // if uinfo in session, populate to context
+			if claims.User != nil { // if uinfo in token populate it to context
 				user := *claims.User
 				for _, admin := range a.Admins {
 					if admin == user.ID {
 						user.Admin = true
 						break
 					}
-					if _, err := a.JWTService.Refresh(w, r); err != nil {
-						log.Printf("[WARN] can't refresh jwt, %s", err)
-					}
 				}
-
+				// refresh token if it close to expiration
+				if _, err := a.JWTService.Refresh(w, r); err != nil {
+					log.Printf("[WARN] can't refresh jwt, %s", err)
+				}
 				r = rest.SetUserInfo(r, user)
 			}
 			h.ServeHTTP(w, r)
diff --git a/app/rest/auth/jwt.go b/app/rest/auth/jwt.go
index 25da24ed..3daaa7f6 100644
--- a/app/rest/auth/jwt.go
+++ b/app/rest/auth/jwt.go
@@ -61,8 +61,7 @@ func (j *JWT) Set(w http.ResponseWriter, claims *CustomClaims) error {
 		MaxAge: cookieExpiration, Secure: j.secureCookies}
 	http.SetCookie(w, &jwtCookie)
 
-	jti := claims.Id
-	xsrfCookie := http.Cookie{Name: xsrfCookieName, Value: jti, HttpOnly: false, Path: "/",
+	xsrfCookie := http.Cookie{Name: xsrfCookieName, Value: claims.Id, HttpOnly: false, Path: "/",
 		MaxAge: cookieExpiration, Secure: j.secureCookies}
 	http.SetCookie(w, &xsrfCookie)
 
@@ -70,7 +69,7 @@ func (j *JWT) Set(w http.ResponseWriter, claims *CustomClaims) error {
 }
 
 // Get jwt from header or cookie
-// if cookie used verify xsrf token to match
+// if cookie used, verify xsrf token to match
 func (j *JWT) Get(r *http.Request) (*CustomClaims, error) {
 
 	fromCookie := false
@@ -114,7 +113,7 @@ func (j *JWT) Get(r *http.Request) (*CustomClaims, error) {
 	return claims, nil
 }
 
-// Refresh gets jwt from request, checks if it will be expiring soon and create new onw
+// Refresh gets jwt from request, checks if it will be expiring soon (1/2 of expiration) and create the new onw
 func (j *JWT) Refresh(w http.ResponseWriter, r *http.Request) (*CustomClaims, error) {
 	claims, err := j.Get(r)
 	if err != nil {