I am not sure if this is a NestJS issue or something else but i'll try my luck here if anyone has any ideas. TLDR is that whenever i compare any refresh token to the hashed refresh token that is stored in the db with bcrypt, bcrypt.compare always returns true if a refresh token is sent that was owned by the user. This is my Refresh Strategy
import { Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { PassportStrategy } from '@nestjs/passport';
import { Request } from 'express';
import { ExtractJwt, Strategy } from 'passport-jwt';
import { FirebaseAuthService } from '../firebase-auth.service';
import TokenPayload from '../interface/tokey-payload.interface';
@Injectable()
export class JwtRefreshTokenStrategy extends PassportStrategy(
Strategy,
'jwt-refresh-token',
) {
constructor(
private readonly configService: ConfigService,
private readonly firebaseAuthService: FirebaseAuthService,
) {
super({
jwtFromRequest: ExtractJwt.fromExtractors([
(request: Request) => {
return request?.body?.refreshToken;
},
]),
secretOrKey: configService.get<string>('JWT_REFRESH_TOKEN_SECRET'),
passReqToCallback: true,
});
}
async validate(request: Request, payload: TokenPayload) {
const refreshToken = request.body.refreshToken;
return this.firebaseAuthService.getUserIfRefreshTokenMatches(
refreshToken,
payload.userId,
);
}
}
and this is where bcrypt always returns true
async getUserIfRefreshTokenMatches(refreshToken: string, userId: string) {
const user = await this.userRepository.findOne({
where: { id: Equal(userId) },
});
const isRefreshTokenMatching = await bcrypt.compare(
refreshToken,
user.currentHashedRefreshToken,
);
if (isRefreshTokenMatching === true) {
return user;
}
}```