Skip to content

fix: integration token refresh test reads cookie instead of JSON body - #91

Merged
Senthil455 merged 1 commit into
Senthil455:mainfrom
DivyashreeR008:fix/integration-token-refresh
Jun 17, 2026
Merged

fix: integration token refresh test reads cookie instead of JSON body#91
Senthil455 merged 1 commit into
Senthil455:mainfrom
DivyashreeR008:fix/integration-token-refresh

Conversation

@DivyashreeR008

Copy link
Copy Markdown
Collaborator

Closes #55

Problem

The integration test assumed the refresh token was returned in the login JSON response body. But the auth service sets it as an httpOnly cookie (auth-service/index.js:713-718) and the /refresh endpoint reads from req.cookies (auth-service/index.js:744).

Lines 106 and 129-131 of run-integration-tests.sh:

  • Line 106 tried to extract refreshToken from the JSON body, which returned empty
  • Lines 129-131 sent the (empty) token as a JSON POST body
  • The || REFRESH_TOKEN="" on line 106 silently swallowed the failure
  • The test always fell through to "Token refresh - no refresh token"

Fix

  • Added curl -c cookie jar to the login request to capture the Set-Cookie header
  • Removed the broken JSON body extraction of refreshToken (it was never in the JSON)
  • Changed the refresh request to use curl -b to send the stored cookie
  • Also passes -c to refresh to capture the rotated refreshToken cookie
  • Cleans up the temp cookie jar file after the test

Testing

The token refresh test now:

  1. Logs in and stores the refreshToken cookie via curl -c
  2. Checks the cookie jar actually contains refreshToken before proceeding
  3. Sends the cookie back on the /refresh call via curl -b
  4. Extracts the new token from the response JSON and continues with it

…e instead of JSON body

The refresh token is set as an httpOnly cookie by the auth service,
but the integration test was trying to extract it from the JSON
response body, which never contained it. The test silently fell
through with an empty string and always reported failure.

Fix: use curl -c/-b cookie jar to capture the Set-Cookie header
from the login response and send it back in the refresh request,
matching how the auth service actually handles refresh tokens.
@Senthil455
Senthil455 merged commit 66ce397 into Senthil455:main Jun 17, 2026
6 of 19 checks passed

@Senthil455 Senthil455 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gh: Not Found (HTTP 404)
{"message":"Not Found","documentation_url":"https://docs.github.com/rest/issues/comments#get-an-issue-comment","status":"404"}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HIGH: Integration token refresh test assumes cookie in JSON body - always fails

2 participants