feature(middleware): JWT refresh token by SolidProgramming · Pull Request #4492 · CactuseSecurity/firewall-orchestrator

SolidProgramming · 2026-04-07T14:17:58Z

Running tests with runsettings

The repository contains two .runsettings files for local dotnet test runs:

FWO.default.runsettings keeps FWO_RUN_INTEGRATION_TESTS=false. Use this for the normal unit test run so tests that require a local FWO environment stay skipped.
FWO.local.runsettings is intended for local integration scenarios. It sets FWO_RUN_INTEGRATION_TESTS=true and reads FWO_TEST_USERNAME plus FWO_TEST_PASSWORD from your local file. Copy FWO.local.runsettings.example to FWO.local.runsettings and replace the placeholders with credentials that are valid in your local test environment.

Typical commands:

dotnet test roles/tests-unit/files/FWO.Test/FWO.Test.csproj --settings FWO.default.runsettings
dotnet test roles/tests-unit/files/FWO.Test/FWO.Test.csproj --settings FWO.local.runsettings

This keeps the default test run safe for everyone while still making it easy to opt into the JWT integration tests locally when a prepared environment is available.

❕ Visual Studio: Select that file in Visual Studio via Test -> Configure Run Settings -> Select Solution Wide runsettings File. With FWO.local.runsettings active, the JWT integration tests are enabled in Test Explorer.

❕ VS Code: tasks(test_default, test_jwt_integration_local) were also added for running default tests and local JWT integration tests via "dotnet test --settings ..." or use Ctrl+Shift+P => Tasks: Run Task => then select "test_default" or "test_jwt_integration_local"

Task: test_jwt_integration_local (FWO.local.runsettings)

Test summary: total: 17; failed: 0; succeeded: 17; skipped: 0;

Task: test_default (FWO.default.runsettings)

Test summary: total: 916; failed: 0; succeeded: 897; skipped: 19;

❕ Please review: ReportJob and DailyCheckJob are affected due to internal jwt lifetime changes.

Under monitoring there will be a new page to view/refresh/revoke the current jwt tokens of the admin user. The page is only added in debug build because of security risks and only for users with admin role.

Closing #1689
Closing #4352

…o newline at end of file

Refactored AuthenticationTokenController to: - Rename TokenPair endpoints for clarity ([HttpPost("Get")] → [HttpPost("GetTokenPair")], [HttpPost("GetForUser")] → [HttpPost("GetTokenPairForUser")). - Add new endpoints to return only JWT strings: [HttpPost("Get")] and [HttpPost("GetForUser")]. - Provide XML documentation for new endpoints.

…essToken(), updating all usages accordingly. Improved TokenService initialization to robustly handle exceptions when reading from session storage, clearing invalid tokens and logging warnings as needed. Extracted token clearing logic to a new private method. Restructured Login.razor form markup for clarity and updated session restoration logic to use the new API and handle errors gracefully. Updated MainLayout.razor to use the new method names. These changes enhance code clarity, error handling, and maintainability.

Added [Authorize] to RefreshToken and RevokeToken endpoints, requiring a valid JWT access token. Changed RefreshToken to return BadRequest (400) for invalid/expired refresh tokens. Introduced a DEBUG-only TestAuth endpoint for testing JWT authentication via Swagger. Enhanced Swagger/OpenAPI docs to include JWT Bearer authentication and security requirements.

Strengthen refresh token rotation by ensuring each refresh token can only be used once. The RevokeRefreshToken method now returns the number of affected rows, and token refresh endpoints verify that exactly one token is revoked before issuing new tokens. Add logging for replay attempts and an integration test to confirm that only one of multiple concurrent refresh requests with the same token succeeds. This mitigates replay attacks and improves overall authentication security.

Refactor user context handling for authentication and token refresh. - Rename and generalize HandleUiUserAtLogin to SynchronizeUiUserContext - Prevent login state updates during refresh token operations. - Simplify JWT creation

…d refresh token

Replaces RequiresGitHubActionsAttribute with RequiresIntegrationEnvironmentAttribute to allow integration tests to run locally or in CI when FWO_RUN_INTEGRATION_TESTS=true. AuthenticationTokenIntegrationTest now reads credentials from environment variables, skipping tests with a clear message if not configured. Updates GitHub Actions workflow to set integration test variables and report test mode. Adds runsettings files for integration test configuration and updates .gitignore. Tests now skip gracefully if credentials are invalid. Improves safety and flexibility for running JWT integration tests.

…-orchestrator into jwt_token_lifetime_internal

Copilot

Pull request overview

Implements JWT refresh-token support across the middleware, UI, and supporting automation, including configurable token lifetimes and additional tests/docs to validate and run the new flow.

Changes:

Introduces access+refresh token pair endpoints (issue/refresh/revoke), refresh-token persistence, and shorter internal-service JWT lifetimes with rotation.
Updates UI authentication/session restoration to store token pairs and periodically refresh expired access tokens.
Adds integration test opt-in via .runsettings, CI wiring, and updated help/docs/examples.

Reviewed changes

Copilot reviewed 90 out of 92 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
roles/ui/files/FWO.UI/wwwroot/css/site.css	Formatting + new help text styles
roles/ui/files/FWO.UI/wwwroot/css/help-code.css	New CSS for code blocks in help pages
roles/ui/files/FWO.UI/Shared/MonitoringLayout.razor	Adds (Debug-only) nav link to JWT token page
roles/ui/files/FWO.UI/Shared/MainLayout.razor	Adds periodic access-token refresh checks + event handling updates
roles/ui/files/FWO.UI/Services/TokenService.cs	New session token-pair storage + refresh/revoke logic
roles/ui/files/FWO.UI/Services/SessionStorageWrapper.cs	Wrapper to abstract protected session storage
roles/ui/files/FWO.UI/Services/PeriodicTaskRunner.cs	Utility for periodic async callbacks
roles/ui/files/FWO.UI/Services/JwtEventService.cs	Removes old static JWT timer/event service
roles/ui/files/FWO.UI/Services/ISessionStorage.cs	New interface for session storage abstraction
roles/ui/files/FWO.UI/Program.cs	Registers TokenService + storage wrapper; uses token pair bootstrap
roles/ui/files/FWO.UI/Pages/Settings/SettingsRoles.razor	Publishes permission-change events via mediator
roles/ui/files/FWO.UI/Pages/Settings/SettingsDefaults.razor	Adds configurable access/refresh token lifetimes with validation
roles/ui/files/FWO.UI/Pages/Monitoring/MonitorJWTToken.razor	New (Debug-only) admin token view/refresh/revoke page
roles/ui/files/FWO.UI/Pages/Logout.razor	Routes logout through async deauthentication cleanup
roles/ui/files/FWO.UI/Pages/Login.razor	Restores auth via token-pair restore flow; uses token pair auth
roles/ui/files/FWO.UI/Pages/Help/HelpSettingsDefaults.cshtml	Documents new token lifetime settings
roles/ui/files/FWO.UI/Pages/Help/HelpLayout.cshtml	Includes new help-code stylesheet
roles/ui/files/FWO.UI/Pages/Help/HelpApiSubnetDataImport.cshtml	Uses formatted code blocks
roles/ui/files/FWO.UI/Pages/Help/HelpApiReporting.cshtml	Updates API examples to token-pair endpoint + formatted blocks
roles/ui/files/FWO.UI/Pages/Help/HelpApiLogin.cshtml	Documents token-pair issuance/refresh/revoke examples
roles/ui/files/FWO.UI/Pages/Help/HelpApiFwoQuery.cshtml	Updates sample queries + formatting
roles/ui/files/FWO.UI/Pages/Help/HelpApiFwoMutation.cshtml	Updates sample mutation + formatting
roles/ui/files/FWO.UI/Pages/Help/HelpApiAppDataImport.cshtml	Reformats JSON sample in help
roles/ui/files/FWO.UI/Auth/AuthStateProvider.cs	Token-pair aware auth, restore, refresh, revoke-on-logout
roles/tests-unit/files/FWO.Test/UiUserHandlerTest.cs	Unit tests for token lifetime lookup defaults
roles/tests-unit/files/FWO.Test/TokenLifetimeProviderTest.cs	Unit tests for lifetime provider behaviors
roles/tests-unit/files/FWO.Test/SimulatedUserConfig.cs	Makes GetText more resilient in tests
roles/tests-unit/files/FWO.Test/PeriodicTaskRunnerTest.cs	Unit test for periodic task runner
roles/tests-unit/files/FWO.Test/Mocks/MockProtectedSessionStorage.cs	Test storage mock implementing ISessionStorage
roles/tests-unit/files/FWO.Test/Mocks/MockMiddlewareClient.cs	Middleware client mock for refresh/revoke calls
roles/tests-unit/files/FWO.Test/LockTest.cs	Adjusts parallelization settings
roles/tests-unit/files/FWO.Test/JwtWriterClaimsTest.cs	Adds test for `jti` claim
roles/tests-unit/files/FWO.Test/InternalApiTokenServiceTest.cs	Tests internal API token rotation/refresh
roles/tests-unit/files/FWO.Test/Helpers/RequiresIntegrationEnvironmentAttribute.cs	Opt-in attribute for integration-style tests
roles/tests-unit/files/FWO.Test/FWO.Test.csproj	Adds MVC testing package for integration test harness
roles/tests-unit/files/FWO.Test/DataGenerators/TokenTestDataBuilder.cs	Builder for auth test data
roles/tests-unit/files/FWO.Test/DataGenerators/AuthTestHelpers.cs	Common assertions for token workflows
roles/tests-unit/files/FWO.Test/ConfigFileTest.cs	Updates expected exception types
roles/tests-unit/files/FWO.Test/AuthenticationTokenIntegrationTest.cs	Adds end-to-end integration tests for refresh/revoke flows
roles/tests-unit/files/FWO.Test/AuthenticationTokenControllerAuditTest.cs	Tests audit-text content for issued tokens
roles/tests-unit/files/FWO.Test/AuthStateProviderTest.cs	Unit tests for restore/refresh/auth-state behavior
roles/tests-integration/tasks/test-auth.yml	Updates Ansible integration test to token-pair endpoint
roles/tests-integration/handlers/main.yml	Adds LDAP cleanup handler for integration test user
roles/sample-auth-data/templates/tree_roles_for_integration_testuser.ldif.j2	Grants reporter role to integration test user
roles/sample-auth-data/templates/tree_integration_testuser_jwt.ldif.j2	Creates integration test user entry
roles/sample-auth-data/tasks/modify_ldap_tree.yml	Ensures integration test user + role are provisioned
roles/middleware/files/FWO.Middleware.Server/UiUserHandler.cs	Adds lifetime-key-based config lookup + refactors user sync
roles/middleware/files/FWO.Middleware.Server/Services/TokenLifetimeProvider.cs	Central token lifetime provider
roles/middleware/files/FWO.Middleware.Server/Services/InternalApiTokenServiceOptions.cs	Options for internal token refresh timing
roles/middleware/files/FWO.Middleware.Server/Services/InternalApiTokenService.cs	Short-lived internal JWT rotation logic
roles/middleware/files/FWO.Middleware.Server/Services/InternalApiTokenRefreshService.cs	Background hosted service for token rotation
roles/middleware/files/FWO.Middleware.Server/RecertCheck.cs	Uses shorter reporter token lifetime
roles/middleware/files/FWO.Middleware.Server/Program.cs	Configures JSON naming policy + registers token refresh services + swagger security
roles/middleware/files/FWO.Middleware.Server/JwtWriter.cs	Adds `jti`, removes ultra-long token lifetimes, adds refresh-token generator
roles/middleware/files/FWO.Middleware.Server/Jobs/ReportJob.cs	Uses capped delegated token lifetime
roles/middleware/files/FWO.Middleware.Server/Jobs/DailyCheckJob.cs	Passes lifetime provider into recert check
roles/lib/files/FWO.Services/EventMediator/Events/PermissionChangedEventArgs.cs	New event args type
roles/lib/files/FWO.Services/EventMediator/Events/PermissionChangedEvent.cs	New event type
roles/lib/files/FWO.Services/EventMediator/Events/JwtExpiredEventArgs.cs	New event args type
roles/lib/files/FWO.Services/EventMediator/Events/JwtExpiredEvent.cs	New event type
roles/lib/files/FWO.Middleware.Client/MiddlewareClient.cs	Switches auth to token-pair endpoint + adds refresh/revoke client calls
roles/lib/files/FWO.Data/Middleware/TokenPair.cs	New DTO for access/refresh tokens
roles/lib/files/FWO.Data/Middleware/RefreshTokenRequest.cs	DTO for refresh/revoke requests
roles/lib/files/FWO.Data/Middleware/RefreshTokenInfo.cs	DTO for refresh-token DB records
roles/lib/files/FWO.Config.File/ConfigFile.cs	Supports env-var overrides for config/key paths + exception changes
roles/lib/files/FWO.Config.Api/UserConfig.cs	Improves API error-code parsing
roles/lib/files/FWO.Config.Api/Data/ConfigData.cs	Adds access/refresh lifetime config fields
roles/lib/files/FWO.Api.Client/Queries/AuthQueries.cs	Adds refresh-token GraphQL queries
roles/lib/files/FWO.Api.Client/GraphQlApiConnection.cs	Removes placeholder expired-JWT special-case
roles/importer/files/importer/import_mgm.py	Parses access token from token-pair response
roles/importer/files/importer/fwo_api.py	Updates login endpoint to token-pair endpoint
roles/database/tasks/install-database.yml	Adds refresh-token table creation to new installs
roles/database/files/upgrade/9.1.0.sql	Upgrade script for refresh_token table
roles/database/files/sql/idempotent/fworch-texts.sql	Adds new UI/help texts for token features
roles/database/files/sql/creation/fworch-create-tables-jwt-refresh.sql	Refresh token table creation script
roles/common/files/fwo-api-calls/auth/storeRefreshToken.graphql	Mutation to persist refresh token hash
roles/common/files/fwo-api-calls/auth/revokeRefreshToken.graphql	Mutation to revoke refresh token
roles/common/files/fwo-api-calls/auth/getRefreshToken.graphql	Query to validate refresh token
roles/api/files/replace_metadata.json	Adds Hasura permissions for refresh_token table
inventory/group_vars/testservers.yml	Adds integration test user config for test servers
inventory/group_vars/all.yml	Bumps product version to 9.1.0
FWO.local.runsettings.example	Example local runsettings enabling integration tests
FWO.default.runsettings	Default runsettings disabling integration tests
CONTRIBUTING.md	Documents runsettings-based test execution
.vscode/tasks.json	Adds VS Code tasks for default vs local JWT integration tests
.gitignore	Ignores local runsettings file
.github/workflows/test-install.yml	Runs JWT integration tests + adjusts Ansible steps

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…-orchestrator into jwt_token_lifetime_internal

sonarqubecloud · 2026-05-13T09:06:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

fix: invalid token with import loop

Copilot

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated 4 comments.

+                @if (IsDebugBuild)
+                {
+                    <li class="nav-item px-2">
+                        <NavLink class="nav-link" href="monitoring/jwttoken">
+                            <span class="@Icons.Credential"></span> JWT Token
+                        </NavLink>
+                    </li>
+                }


            // There was an error trying to authenticate the user. Probably invalid credentials
-            errorMessage = ( authResponse.Data != null ? userConfig.GetApiText(authResponse.Data) : "Middleware Api Error: " + authResponse.Content );
+            errorMessage = (authResponse.Content != null ? userConfig.GetApiText(authResponse.Content) : "Middleware Api Error: " + authResponse.Content);
        }


+{
+    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
+    "refreshToken": "a7f3c8b9e2d1...",
+    "accessTokenExpires": "2025-12-11T14:30:00Z",
+    "refreshTokenExpires": "2026-01-10T12:00:00Z"
+}


+{
+    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
+    "refreshToken": "a7f3c8b9e2d1...",
+    "accessTokenExpires": "2025-12-11T14:30:00Z",
+    "refreshTokenExpires": "2026-01-10T12:00:00Z"
+}


sonarqubecloud · 2026-05-15T07:07:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

tpurschke

last medium finding will be moved to a separate issue

tpurschke · 2026-04-15T09:05:47Z

          dotnet build
          dotnet test --filter "Name=HtmlToPdfTest"

+      - name: Run JWT refresh integration tests


i guess we need to have a small meeting regarding this point today 12:30 pm?

SolidProgramming and others added 30 commits March 6, 2026 11:35

clean

526b8f6

fix Error: roles/importer/files/importer/import_mgm.py:213:15: W292 N…

3e2dec7

…o newline at end of file

Merge branch 'develop' into jwt_merged_fixed_clean

69f5634

fix test-auth

db35845

fix: logout/deauthentication handling and robustness

16f43cf

add revoked_at IS_NULL requirement for token revocation

d5e84b2

comment for clarity

f20d97b

merge from cactus/develop

4eecba5

add create table file for refresh_tokens

8e36c30

add refresh token sql file to install script

37f2ab7

typo fix

24df45a

help page minor text changes and typo fixes

96c8149

test

48a6f5d

.

f2711c9

Merge branch 'develop' into jwt_merged_fixed_clean

47360dd

Merge branch 'develop' into jwt_merged_fixed_clean

c9d4029

Merge branch 'develop' into jwt_merged_fixed_clean

0aa9d5c

Merge branch 'develop' into jwt_merged_fixed_clean

00b51dc

Merge branch 'develop' into jwt_merged_fixed_clean

6d30088

fix(auth): update refresh token test to expect BadRequest status

8eafc3c

refactor(docs): edited some summarys

294f590

refactor(auth): remove authorize attribute

67c7b00

refactor(auth): clarify and control UI user context sync

4e1f0d5

Refactor user context handling for authentication and token refresh. - Rename and generalize HandleUiUserAtLogin to SynchronizeUiUserContext - Prevent login state updates during refresh token operations. - Simplify JWT creation

fix(auth): change response from BadRequest to Unauthorized for invali…

d776cb3

…d refresh token

test user loggin and formatting

871b265

SolidProgramming and others added 4 commits April 20, 2026 14:23

Merge branch 'develop' into jwt_token_lifetime_internal

43301e8

Merge branch 'develop' of https://github.com/CactuseSecurity/firewall…

3c27b4b

…-orchestrator into jwt_token_lifetime_internal

Merge branch 'develop' of https://github.com/CactuseSecurity/firewall…

b27f582

…-orchestrator into jwt_token_lifetime_internal

Merge branch 'develop' of https://github.com/CactuseSecurity/firewall…

002c990

…-orchestrator into jwt_token_lifetime_internal

Y4nnikH requested a review from Copilot April 29, 2026 08:26

Copilot started reviewing on behalf of Y4nnikH April 29, 2026 08:26 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

SolidProgramming and others added 6 commits May 4, 2026 10:34

Merge branch 'develop' of https://github.com/CactuseSecurity/firewall…

53f703e

…-orchestrator into jwt_token_lifetime_internal

Merge branch 'develop' into jwt_token_lifetime_internal

b881574

Merge branch 'develop' of https://github.com/CactuseSecurity/firewall…

2ea5f05

…-orchestrator into jwt_token_lifetime_internal

Merge branch 'develop' into jwt_token_lifetime_internal

3ee3976

Merge branch 'develop' of https://github.com/CactuseSecurity/firewall…

c2daeab

…-orchestrator into jwt_token_lifetime_internal

remove jwt test site

145be92

ErikPre and others added 4 commits May 13, 2026 13:22

fix: fix invalid token

fafca45

fix: Change Standard sleep time back

6bc3d6c

Merge pull request #2 from weichwaren-schmiede/fix/invalid-token

d5b050a

fix: invalid token with import loop

Merge branch 'develop' into jwt_token_lifetime_internal

42b089e

Y4nnikH requested a review from Copilot May 15, 2026 06:48

Copilot started reviewing on behalf of Y4nnikH May 15, 2026 06:49 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

remove nav link

a74ff68

Y4nnikH approved these changes May 19, 2026

View reviewed changes

Y4nnikH requested a review from tpurschke May 19, 2026 12:32

tpurschke approved these changes May 19, 2026

View reviewed changes

tpurschke mentioned this pull request May 19, 2026

JWT refresh delegated tokens #4654

Open

Y4nnikH merged commit 98a9ca1 into CactuseSecurity:develop May 19, 2026
4 checks passed

github-project-automation Bot moved this from In progress to Done in FWO UI May 19, 2026

github-project-automation Bot moved this from In progress to Done in FWO API May 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature(middleware): JWT refresh token#4492

feature(middleware): JWT refresh token#4492
Y4nnikH merged 106 commits into
CactuseSecurity:developfrom
SolidProgramming:jwt_token_lifetime_internal

SolidProgramming commented Apr 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented May 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

sonarqubecloud Bot commented May 15, 2026

Uh oh!

tpurschke left a comment

Uh oh!

tpurschke Apr 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

SolidProgramming commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Running tests with runsettings

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented May 13, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

sonarqubecloud Bot commented May 15, 2026

Quality Gate passed

Uh oh!

tpurschke left a comment

Choose a reason for hiding this comment

Uh oh!

tpurschke Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

SolidProgramming commented Apr 7, 2026 •

edited

Loading