Steps to reproduce
Right now there appears to be two possible behaviors when a refresh token is refreshed.
- If the
previous_refresh_token column exists then the refresh token / access token are both revoked when the TokenInfoController::show action is requested for the first time.
- It would help if the comment describing this behavior were more specific about what "used" means.
- If it does not exist both the refresh and access token are revoked immediately.
Desired behavior
I was wondering why we revoke both the refresh and access token at the same time when revoked immediately. I would have expected that the refresh token would be revoked, but that the old access token would remain valid until it expired. I had assumed I missed something in the RFC about this but could not find anything. I would try and hack this in, but since refresh tokens and access tokens use the same model + column for revocation it was not straight forward.
Steps to reproduce
Right now there appears to be two possible behaviors when a refresh token is refreshed.
previous_refresh_tokencolumn exists then the refresh token / access token are both revoked when theTokenInfoController::showaction is requested for the first time.Desired behavior
I was wondering why we revoke both the refresh and access token at the same time when revoked immediately. I would have expected that the refresh token would be revoked, but that the old access token would remain valid until it expired. I had assumed I missed something in the RFC about this but could not find anything. I would try and hack this in, but since refresh tokens and access tokens use the same model + column for revocation it was not straight forward.