Authentication Overview

​

Overview

• Access & Refresh Token Pattern: Short-lived access tokens (15 minutes) with long-lived refresh tokens (7 days)
• Token Rotation: Refresh tokens are automatically rotated on each use to prevent reuse attacks
• HttpOnly Cookies: Tokens are stored in secure, HttpOnly cookies for enhanced security
• Brute Force Protection: Account lockout after 5 failed login attempts for 15 minutes
• Device Tracking: All sessions are tracked by device and IP address
• Rate Limiting: All auth endpoints are rate-limited (5 requests per 15 minutes)

​

Security Features

​

Password Requirements

• Minimum 8 characters
• At least 1 uppercase letter
• At least 1 lowercase letter
• At least 1 number
• At least 1 special character (!@#$%^&*…)
• Not a common password

​

Token Storage

• accessToken: Access token cookie (15 minutes)
• refreshToken: Refresh token cookie (7 days)

​

Account Lockout

​

Authentication Flow

1. Register or Login to receive tokens via cookies
2. Access Protected Routes - cookies are automatically included
3. Refresh Token when the access token expires (before making requests)
4. Logout to revoke tokens and clear cookies

​

Available Endpoints

​

Error Codes

​

Common Error Responses

​

Validation Error (400)

{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR",
  "message": "Senha deve ter no mínimo 8 caracteres"
}

​

Unauthorized (401)

{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "message": "E-mail ou senha inválidos"
}

​

Account Locked (429)

{
  "success": false,
  "error": "Rate limit exceeded",
  "code": "RATE_LIMIT",
  "message": "Conta bloqueada temporariamente. Tente novamente em 15 minutos."
}