@mihaelkonjevic in the realworld example, once the user is logged in with jwt, hot code reloading does not log one out. I’m trying to replicate the login functionality, but code changes -> hot reload keeps logging me out. Is the secret sauce in the datasources namespace (current user?)

@sooheon https://github.com/gothinkster/clojurescript-keechma-realworld-example-app/blob/master/src/cljs/realworld/forms/login.cljs#L24 and https://github.com/gothinkster/clojurescript-keechma-realworld-example-app/blob/master/src/cljs/realworld/datasources.cljs#L48

on register / login I store the JWT in local storage

and then get it out from the local storage from the datasource

Hah! I thought I’d done that, turns out I spelled the local storage key differently in two places ;P

now I see why you have the settings ns

🙂

btw, I’m still thinking about the input fields for Korean and similar language

let me know what I can do to help with that--my workaround now is just not fully control the form (don’t bind value)

I think I have and idea how to fix it (probably on the component level), but work is kinda chaotic this week

sure, no rush

btw, how do you do keepalive/refresh for the jwt?

either refresh it on each app load

and / or check when it’s expiring here https://github.com/gothinkster/clojurescript-keechma-realworld-example-app/blob/master/src/cljs/realworld/datasources.cljs#L48

and return nil if it’s expired

mhm. so if you don’t refresh each app load, and that returns nil, that just means user needs to login again?

yes

the only issue is if the jwt expires in the middle of user’s session

physical session, not server session right? i thought point of jwt was to replace sessions

yeah, user is clicking around and then requests start to fail because jwt is expired

mhm that’s pretty bad

it also seems you don’t really decode the jwt clientside, you jsut assume that if it exists, it means they’ve been authenticated?

so technically someone can just add a random string as jwt header and make calls

in this project yeah, but JWT is readable on the client side

yeap

only thing that it ensures is that you can’t tamper with it because of the signature