Refresh route + axios retry on 401 (instead of current sign-out). Email verification already shipped.
Cross-stack issues:
- Node#26 — Refresh token rotation (open)
- Vue#30 — Axios interceptor 401 → refresh → retry (open)
Scope: Node POST /api/auth/refresh (access 15min / refresh 7d, rotation on each use) + Vue axios interceptor.
Acceptance: expired token → transparent refresh → original request retried; sign-out only if refresh fails.
Sub-issue of Auth & session hardening (#3804).
Refresh route + axios retry on 401 (instead of current sign-out). Email verification already shipped.
Cross-stack issues:
Scope: Node
POST /api/auth/refresh(access 15min / refresh 7d, rotation on each use) + Vue axios interceptor.Acceptance: expired token → transparent refresh → original request retried; sign-out only if refresh fails.
Sub-issue of Auth & session hardening (#3804).