Hamza/saqel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Redis session mismatch in AuthMiddleware and ensure instant Onboarding UI transition

Browse Source
This commit is contained in:
Hamza-Ayed
2026-08-26 23:46:48 +03:00
parent cdb08331c0
commit fe66f05057
3 changed files with 46 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/Middlewares/AuthMiddleware.php
+29 -19
View File
@@ -5,6 +5,7 @@ namespace App\Middlewares;
use App\Core\Request;
use App\Core\Response;
use App\Core\Security;
use App\Core\RedisClient;
class AuthMiddleware
{
@@ -16,7 +17,7 @@ class AuthMiddleware
$authHeader = $request->getHeader('authorization', '');
if (!$authHeader || !preg_match('/Bearer\s(\S+)/i', $authHeader, $matches)) {
$response->json(['error' => 'Unauthorized', 'message' => 'Token not provided or invalid format'], 401);
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'Token not provided or invalid format']);
exit;
}
@@ -24,33 +25,42 @@ class AuthMiddleware
$payload = Security::verifyJWT($token);
if (!$payload) {
$response->json(['error' => 'Unauthorized', 'message' => 'Invalid or expired token'], 401);
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'Invalid or expired token']);
exit;
}
// Check if session is active in Redis
try {
$redis = \App\Core\RedisClient::getInstance();
$userId = $payload['user_id'];
$sessionState = $redis->get("session:{$userId}:{$token}");
if (!$sessionState || $sessionState !== 'active') {
$response->json(['error' => 'Unauthorized', 'message' => 'Session has been revoked or expired'], 401);
exit;
}
} catch (\Exception $e) {
// If Redis is down, we fallback to just JWT verification
error_log("AuthMiddleware Redis Error: " . $e->getMessage());
}
// Validate required custom payload elements
if (!isset($payload['user_id']) || !isset($payload['role'])) {
$response->json(['error' => 'Unauthorized', 'message' => 'Malformed token payload structure'], 401);
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'Malformed token payload structure']);
exit;
}
$userId = (int)$payload['user_id'];
// Check if session is active in Redis (Single Active Device / Session Tracking)
try {
$redis = RedisClient::getInstance();
$sessionData = $redis->get("active_session:{$userId}");
if ($sessionData) {
$session = json_decode($sessionData, true);
$expectedSig = substr($token, -32);
if (is_array($session) && isset($session['token_signature']) && $session['token_signature'] !== $expectedSig) {
$response->status(401)->json([
'error' => 'Unauthorized',
'message' => 'تم تسجيل الدخول من جهاز أو متصفح آخر. يرجى إعادة تسجيل الدخول.'
]);
exit;
}
}
} catch (\Exception $e) {
// If Redis is temporarily unreachable, fallback gracefully to JWT verification
error_log("AuthMiddleware Redis Warning: " . $e->getMessage());
}
// Attach user info to the Request instance dynamically so controllers can use it
$request->user_id = $payload['user_id'];
$request->user_id = $userId;
$request->role = $payload['role'];
$request->uuid = $payload['uuid'] ?? null;
}
}