starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #4444] [MERGED] Implement new JWT auth #4255

New Issue
Closed
opened 2026-04-25 00:19:01 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:19:01 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/4444
Author: @advplyr
Created: 6/30/2025
Status: ✅ Merged
Merged: 7/12/2025
Merged by: @advplyr

Base: master ← Head: jwt_auth_refactor

📝 Commits (10+)

  • 4f5123e Implement new JWT auth
  • d96ed01 Set up ApiKey model and create Api Key endpoint
  • af1ff12 Add get all, update and delete endpoints. Add api keys config page
  • 4d32a22 Update API Keys to be tied to a user, add apikey lru-cache, handle deactivating expired keys
  • 8b995a1 Add support for returning refresh token for mobile clients
  • 44ff90a Update refresh endpoint to support override cookie token
  • f127a7b Update router for internal-api routes
  • cdc37dd Use x-refresh-token for alt method of passing refresh token, check x-refresh-token for logout
  • 8dbe1e4 Fix express.json position
  • e59babd Force re-login if using old token, show alert if admin user, add isOldToken flag to user

📊 Changes

52 files changed (+3168 additions, -862 deletions)

View changed files

📝 client/components/app/ConfigSideNav.vue (+5 -0)
📝 client/components/app/LazyBookshelf.vue (+0 -6)
📝 client/components/cards/AuthorCard.vue (+0 -3)
📝 client/components/covers/AuthorImage.vue (+0 -3)
📝 client/components/modals/AccountModal.vue (+3 -6)
➕ client/components/modals/ApiKeyCreatedModal.vue (+60 -0)
➕ client/components/modals/ApiKeyModal.vue (+198 -0)
📝 client/components/modals/Modal.vue (+2 -2)
📝 client/components/modals/item/tabs/Files.vue (+0 -3)
📝 client/components/player/PlayerUi.vue (+0 -3)
📝 client/components/readers/ComicReader.vue (+1 -7)
📝 client/components/readers/EpubReader.vue (+39 -28)
📝 client/components/readers/MobiReader.vue (+2 -8)
📝 client/components/readers/PdfReader.vue (+30 -2)
📝 client/components/readers/Reader.vue (+0 -3)
➕ client/components/tables/ApiKeysTable.vue (+177 -0)
📝 client/components/tables/EbookFilesTable.vue (+0 -3)
📝 client/components/tables/LibraryFilesTable.vue (+0 -3)
📝 client/components/ui/MultiSelectQueryInput.vue (+0 -3)
📝 client/components/ui/SelectInput.vue (+7 -2)

...and 32 more files

📄 Description

Brief summary

Changes

  • Adds new JWT authentication with refresh tokens (env variables can override expiry times)
  • Adds Session model to store refresh tokens
  • Adds ApiKey model with admin config page for managing api keys
  • Simple rate limiter with env variable overrides for auth endpoints (oidc, login & change password)
  • Update password change endpoint (/api/me/password) to return error status codes
  • Update web client to handle refreshing tokens
  • Refactor Auth.js into separate files
  • New JWT_SECRET_KEY env variable that takes priority over the one stored in the db (if changed this will make the old tokens unusable thus breaking any 3rd party apps not using the new access tokens)

This doesn't introduce any breaking changes for 3rd party apps/scripts. The old tokens are still returned with the user object and newly created users still get a legacy token. However, we will come up with a plan on how to fully phase out the old tokens.

In-depth Description

In discussion https://github.com/advplyr/audiobookshelf/discussions/4460

Screenshots

All users will see this message when authentication with an old token. Only admin users will see the "More info" link that goes to the github discussion.
image

image

image

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/4444 **Author:** [@advplyr](https://github.com/advplyr) **Created:** 6/30/2025 **Status:** ✅ Merged **Merged:** 7/12/2025 **Merged by:** [@advplyr](https://github.com/advplyr) **Base:** `master` ← **Head:** `jwt_auth_refactor` --- ### 📝 Commits (10+) - [`4f5123e`](https://github.com/advplyr/audiobookshelf/commit/4f5123e84260b8e1e1049d9ce82854c7ca7f6afa) Implement new JWT auth - [`d96ed01`](https://github.com/advplyr/audiobookshelf/commit/d96ed01ce473c60c91b1af5fa0a825a979e23f51) Set up ApiKey model and create Api Key endpoint - [`af1ff12`](https://github.com/advplyr/audiobookshelf/commit/af1ff12dbb95dbbc9321d9f8fb1dfafcbece5f35) Add get all, update and delete endpoints. Add api keys config page - [`4d32a22`](https://github.com/advplyr/audiobookshelf/commit/4d32a22de9268fc1ec4e3d3d9f2bfb75fa4dfd6c) Update API Keys to be tied to a user, add apikey lru-cache, handle deactivating expired keys - [`8b995a1`](https://github.com/advplyr/audiobookshelf/commit/8b995a179ddf52fedcd1275edbe0a091465485e7) Add support for returning refresh token for mobile clients - [`44ff90a`](https://github.com/advplyr/audiobookshelf/commit/44ff90a6f2aa354a2cc4c58bd4b7c7ac9d8efe81) Update refresh endpoint to support override cookie token - [`f127a7b`](https://github.com/advplyr/audiobookshelf/commit/f127a7beb548e29969873027c6d4389dadb9a13a) Update router for internal-api routes - [`cdc37dd`](https://github.com/advplyr/audiobookshelf/commit/cdc37ddb0f71c74c4caf1f53dbb9cf891b3768a7) Use x-refresh-token for alt method of passing refresh token, check x-refresh-token for logout - [`8dbe1e4`](https://github.com/advplyr/audiobookshelf/commit/8dbe1e4e5d2fac4ed1b20e4cc3dcd52abc14a168) Fix express.json position - [`e59babd`](https://github.com/advplyr/audiobookshelf/commit/e59babdf24cfa3283b9ea6fd6c8f0e22a76f15ec) Force re-login if using old token, show alert if admin user, add isOldToken flag to user ### 📊 Changes **52 files changed** (+3168 additions, -862 deletions) <details> <summary>View changed files</summary> 📝 `client/components/app/ConfigSideNav.vue` (+5 -0) 📝 `client/components/app/LazyBookshelf.vue` (+0 -6) 📝 `client/components/cards/AuthorCard.vue` (+0 -3) 📝 `client/components/covers/AuthorImage.vue` (+0 -3) 📝 `client/components/modals/AccountModal.vue` (+3 -6) ➕ `client/components/modals/ApiKeyCreatedModal.vue` (+60 -0) ➕ `client/components/modals/ApiKeyModal.vue` (+198 -0) 📝 `client/components/modals/Modal.vue` (+2 -2) 📝 `client/components/modals/item/tabs/Files.vue` (+0 -3) 📝 `client/components/player/PlayerUi.vue` (+0 -3) 📝 `client/components/readers/ComicReader.vue` (+1 -7) 📝 `client/components/readers/EpubReader.vue` (+39 -28) 📝 `client/components/readers/MobiReader.vue` (+2 -8) 📝 `client/components/readers/PdfReader.vue` (+30 -2) 📝 `client/components/readers/Reader.vue` (+0 -3) ➕ `client/components/tables/ApiKeysTable.vue` (+177 -0) 📝 `client/components/tables/EbookFilesTable.vue` (+0 -3) 📝 `client/components/tables/LibraryFilesTable.vue` (+0 -3) 📝 `client/components/ui/MultiSelectQueryInput.vue` (+0 -3) 📝 `client/components/ui/SelectInput.vue` (+7 -2) _...and 32 more files_ </details> ### 📄 Description ## Brief summary Changes - Adds new JWT authentication with refresh tokens (env variables can override expiry times) - Adds `Session` model to store refresh tokens - Adds `ApiKey` model with admin config page for managing api keys - Simple rate limiter with env variable overrides for auth endpoints (oidc, login & change password) - Update password change endpoint (`/api/me/password`) to return error status codes - Update web client to handle refreshing tokens - Refactor `Auth.js` into separate files - New `JWT_SECRET_KEY` env variable that takes priority over the one stored in the db (if changed this will make the old tokens unusable thus breaking any 3rd party apps not using the new access tokens) This doesn't introduce any breaking changes for 3rd party apps/scripts. The old tokens are still returned with the user object and newly created users still get a legacy token. However, we will come up with a plan on how to fully phase out the old tokens. ## In-depth Description In discussion https://github.com/advplyr/audiobookshelf/discussions/4460 ## Screenshots All users will see this message when authentication with an old token. Only admin users will see the "More info" link that goes to the github discussion. <img width="614" height="651" alt="image" src="https://github.com/user-attachments/assets/8a2183a2-d0c0-410d-83d9-e98820db0332" /> ![image](https://github.com/user-attachments/assets/837d4a32-830f-407a-9f81-82dc52f881a3) ![image](https://github.com/user-attachments/assets/a0923cca-f1ca-4dcf-a6b4-288a11d54aa5) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:19:01 +02:00
adam closed this issue 2026-04-25 00:19:01 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#4255
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?