Authentication

Token Identity Format

{
    "id": 0,
    "university_id": 1,
    "email": "[email protected]",
    "first_name": "John",
    "last_name": "Doe",
    "picture": "https://lh3.googleusercontent.com/-ByXCWfs-xjA/AAAAAAAAAAAAAAAAA/rabka12c/s96-c/photo.jpg",
    "type": "s",
    "permissions": [
      2
    ],
    "gender": "m",
    "graduation_year": 2018,
    "majors": [
      44
    ]
}

Sign-In Flow

1. Front-End authenticates with Google OAuth
2. POST id_token to /auth a. Format is {"id_token": "ID_TOKEN"}
3. /auth will return a JWT that contains the current user's identity (name, email, etc.)
4. Front-End stores the JWT in local storage

Sign-Out Flow

1. Delete JWT

Website Enter Flow

1. Front-End checks if user has a JWT
2. If it does, validate it against GET /auth/validate
3. Use the normal authentication header, and if the token is valid, a new token will be returned in the following format: {"jwt": "NEW_JWT"}
4. If not valid, delete the JWT

Request Flow

Include the following header: Authorization: Bearer JWT_TOKEN