修复刷新 token 的 BUG

ecodeclub · Mar 26, 2024 · 541ac1c · 541ac1c
1 parent 2c593de
commit 541ac1c
Showing 1 changed file with 3 additions and 5 deletions.
diff --git a/session/redis/provider.go b/session/redis/provider.go
@@ -58,11 +58,9 @@ func (rsp *SessionProvider) RenewAccessToken(ctx *ginx.Context) error {
 	}
 	claims := jwtClaims.Data
 	sess := newRedisSession(claims.SSID, rsp.expiration, rsp.client, claims)
-	defer func() {
-		// refresh_token 只能用一次，不管成功与否
-		_ = sess.Del(ctx, keyRefreshToken)
-	}()
 	oldToken := sess.Get(ctx, keyRefreshToken).StringOrDefault("")
+	// refresh_token 只能用一次，不管成功与否
+	_ = sess.Del(ctx, keyRefreshToken)
 	// 说明这个 rt 是已经用过的 refreshToken
 	// 或者 session 本身就已经过期了
 	if oldToken != rt {
@@ -144,7 +142,7 @@ func (rsp *SessionProvider) Get(ctx *gctx.Context) (session.Session, error) {
 func NewSessionProvider(client redis.Cmdable, jwtKey string) *SessionProvider {
 	// 长 token 过期时间，被看做是 Session 的过期时间
 	expiration := time.Hour * 24 * 30
-	m := ijwt.NewManagement[session.Claims](ijwt.NewOptions(time.Hour, jwtKey),
+	m := ijwt.NewManagement[session.Claims](ijwt.NewOptions(time.Second*30, jwtKey),
 		ijwt.WithRefreshJWTOptions[session.Claims](ijwt.NewOptions(expiration, jwtKey)))
 	return &SessionProvider{
 		client:      client,