Skip to content

Refresh tokens need a grace period to deal with network errors and similar issues #1831

@NavindrenBaskaran

Description

@NavindrenBaskaran

So basically, on Hydra if the refresh token is already used to request for a new set of tokens, that refresh token is invalidated and can't be used to request for a new set of tokens. It's a one time use only.

At the event, where the tokens were actually issued by Hydra but the response was not sent to the users because of some network issues, the users are generally stuck. Is there a way for us to not invalidate the refresh token immediately and have a refresh token grace period to perform a duplicate refresh requests with the same refresh token.

Metadata

Metadata

Assignees

No one assigned

    Labels

    breaking changeChanges behavior in a breaking manner.package/oauth2rfcA request for comments to discuss and share ideas.

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions