RefreshTokenController
extends AbstractController
in package
Manages the lifecycle of the mobile API refresh tokens: renewal of a JWT access token, revocation of a token and revocation of all of a user's tokens.
Table of Contents
Properties
- $jwtManager : JWTTokenManagerInterface
- $refreshTokenService : RefreshTokenService
Methods
- __construct() : mixed
- refresh() : JsonResponse
- Exchanges a valid refresh token for a new JWT access token and a new refresh token (rotation).
- revoke() : JsonResponse
- Revokes a specific refresh token.
- revokeAll() : JsonResponse
- Revokes all refresh tokens of the currently authenticated user (for example when logging out of all devices).
Properties
$jwtManager
private
JWTTokenManagerInterface
$jwtManager
$refreshTokenService
private
RefreshTokenService
$refreshTokenService
Methods
__construct()
public
__construct(RefreshTokenService $refreshTokenService, JWTTokenManagerInterface $jwtManager) : mixed
Parameters
- $refreshTokenService : RefreshTokenService
-
Refresh-token lifecycle management.
- $jwtManager : JWTTokenManagerInterface
-
JWT access-token generator.
refresh()
Exchanges a valid refresh token for a new JWT access token and a new refresh token (rotation).
public
refresh(Request $request) : JsonResponse
Parameters
- $request : Request
-
JSON request containing "refresh_token".
Attributes
- #[Route]
- '/api/token/refresh'
- $name: 'api_refresh_token'
- $methods: ['POST']
Return values
JsonResponse —New tokens and user information; 400 if the token is missing, 401 if it is invalid/expired, 500 on an unexpected error.
revoke()
Revokes a specific refresh token.
public
revoke(Request $request) : JsonResponse
Parameters
- $request : Request
-
JSON request containing "refresh_token".
Attributes
- #[Route]
- '/api/token/revoke'
- $name: 'api_revoke_token'
- $methods: ['POST']
Return values
JsonResponse —400 if the token is missing, 404 if it is not found, 200 on success.
revokeAll()
Revokes all refresh tokens of the currently authenticated user (for example when logging out of all devices).
public
revokeAll() : JsonResponse
Attributes
- #[Route]
- '/api/token/revoke-all'
- $name: 'api_revoke_all_tokens'
- $methods: ['POST']
Return values
JsonResponse —401 if no user is authenticated, 200 otherwise.