Strapi Admin Custom Auth

Extending Strapi's admin auth to have refresh tokens and revoke method and prevent concurrent sessions for strict security measures.

Install

npm i strapi-admin-refresh-token

or

yarn add strapi-admin-refresh-token

Enable

Add to config/plugins.js (CJS) or config/plugins.ts (ESM).

CJS

module.exports = () => ({
  'strapi-admin-refresh-token': {
    enabled: true
  },
});

ESM

export default () => ({
  'strapi-admin-refresh-token': {
    enabled: true
  },
});

Then rebuild the admin:

npm run build && npm run develop

🔑 Main Features

• Refresh Token Support: Adds a secure /refresh endpoint for extending admin sessions without re-login.\
• Plug-and-Play Admin Integration: Admin-side code automatically manages refresh intervals and calls the /refresh endpoint.\
• Customizable Settings: Configurable refresh interval, token TTL, cookie names, secure flags, and binding rules.\
• Admin Guard Middleware: Protects sensitive admin endpoints by verifying session validity before allowing access.\
• Login Seed: Seeds a secure, bound session on login to bootstrap refresh-token management seamlessly.

🛡️ Extra Security Features

• Cookie Security Controls:

  • HttpOnly, Secure, and SameSite flags configurable for refresh cookies.\
  • Session cookies or persistent cookies based on requirements.

• Token Hashing: Refresh tokens are stored hashed in the DB (via sha256), so raw tokens are never persisted.

• Session Revocation: Admin sessions can be revoked instantly (DB record revoked → token rejected on next use).

• Idle Timeout: Sessions expire after configurable inactivity, reducing the risk of hijacked long-lived tokens.

• IP & User-Agent Binding: Option to bind sessions to the original IP/UA, preventing token reuse on another device.

• Expiry Enforcement: Sessions with expired TTL are denied even if the cookie/token is presented.

• Guard Enforcement: Middleware ensures only requests with a valid session proceed, otherwise redirecting/rejecting.

👉 In short:
Default Strapi relies only on its JWT-based admin session, which can expire abruptly.
Your plugin introduces refresh-based session extension + security hardening (hashing, cookie flags, revocation, IP/UA binding, TTLs, guard checks).