Refresh Token Automatic Reuse Detection

[JanikoNaber]

I'm looking for a reuse detection for refresh tokens. Like described here https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/#Refresh-Token-Automatic-Reuse-Detection or here https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-13#section-4.12

Currently (as far as I understood it), its possible for a third person to use a compromised refresh token forever, as soon as this third person has refreshed the token before the user did it.

What do you think, is that something we should implement? Or do I just have not seen it, and its already there?

[jorenvandeweyer]

Hi there 👋

You'll have to add some additional logic in your getRefreshToken function to implement this behaviour.

async function getRefreshToken(token: string): Promise<RefreshToken | falsey> {
  const refreshToken = refreshTokenRepository.findByToken(token)
  const user = userRepository.findOne(refreshToken.userUuid)
  const client = clientRepository.findOne(refreshToken.clientUuid)
  
  if (!refreshToken) {
    return null
  } else if (refreshToken.deletedAt) {
    refreshTokenRepository.deleteAllLinkedRefreshTokens(token)
    
    return null
  } else {
      return {
        refreshToken: token,
        user,
        client
      }
  }
}

So you'll also need to find a way to link all newly generated refreshTokens from generateRefreshToken to the initial token that was generated.

I think you can achieve this with a "hacky" modification of the getRefreshToken function, since the user returned from this function is used as an input parameter of the saveToken function.

} else {
 user.initialRefreshTokenUuid = refreshToken.initialUuid ?? refreshToken.uuid

 return {
   refreshToken: token,
   user,
   client
 }
}

So now you can implement the saveToken function to link all newly generated refreshTokens together

function saveToken (token: Token, client: Client, user: User): Promise<string> {  
  await refreshTokenRepository.insert({
    initialUuid: user.initialRefreshTokenUuid,
    refreshToken: token.refreshToken
  })
}

[JanikoNaber]

Sorry for my late answer, was on vacation.
Thank you very much, that looks good. I will try it.
The "hack" with the user object to forward the token, is maybe no the nicest way, but exactly what I need.
As a possible extension, we could forward the old token into saveToken, so that we do not need the user object for that. But maybe nice to have. For now I'm happy.