Implement jwt refresh count check

login/handler.go

@@ -183,9 +183,12 @@ func (h *Handler) handleAuthentication(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) handleRefresh(w http.ResponseWriter, r *http.Request, userInfo model.UserInfo) {
-	h.respondAuthenticated(w, r, userInfo)
-	logging.Application(r.Header).WithField("username", userInfo.Sub).Info("refreshed jwt")
-	return
+	if userInfo.Refreshes >= h.config.JwtRefreshes {
+		h.respondMaxRefreshesReached(w, r)
+	} else {
+		h.respondAuthenticated(w, r, userInfo)
+		logging.Application(r.Header).WithField("username", userInfo.Sub).Info("refreshed jwt")
+	}
 }
 
 func (h *Handler) deleteToken(w http.ResponseWriter) {
@@ -294,6 +297,11 @@ func (h *Handler) respondNotFound(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprintf(w, "Not Found: The requested page does not exist")
 }
 
+func (h *Handler) respondMaxRefreshesReached(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(403)
+	fmt.Fprint(w, "Max JWT refreshes reached")
+}
+
 func (h *Handler) respondAuthFailure(w http.ResponseWriter, r *http.Request) {
 	if wantHTML(r) {
 		w.Header().Set("Content-Type", contentTypeHTML)

login/handler_test.go

@@ -26,6 +26,7 @@ func testConfig() *Config {
 	testConfig.LoginPath = "/context/login"
 	testConfig.CookieDomain = "example.com"
 	testConfig.CookieExpiry = 23 * time.Hour
+	testConfig.JwtRefreshes = 1
 	return testConfig
 }
 
@@ -299,6 +300,24 @@ func TestHandler_Refresh_Invalid_Token(t *testing.T) {
 	Equal(t, 0, len(setCookieList))
 }
 
+func TestHandler_Refresh_Max_Refreshes_Reached(t *testing.T) {
+	h := testHandler()
+	input := model.UserInfo{Sub: "bob", Expiry: time.Now().Add(time.Second).Unix(), Refreshes:1}
+	token, err := h.createToken(input)
+	NoError(t, err)
+
+	cookieStr := "Cookie: "+h.config.CookieName + "=" + token + ";"
+
+	// refreshSuccess
+	recorder := call(req("POST", "/context/login", "", AcceptJwt, TypeJwt, cookieStr))
+	Equal(t, 403, recorder.Code)
+	Contains(t, recorder.Body.String(), "reached")
+
+	// verify the token from the cookie
+	setCookieList := readSetCookies(recorder.Header())
+	Equal(t, 0, len(setCookieList))
+}
+
 func TestHandler_Logout(t *testing.T) {
 	// DELETE
 	recorder := call(req("DELETE", "/context/login", ""))