Before hitting the database, check if the refresh ticket is at least 5m old and reject it or return the same token. This will help mitigate refresh loops on the client side.
Open
area-identity
enhancement
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
Before hitting the database, check if the refresh ticket is at least 5m old and reject it or return the same token. This will help mitigate refresh loops on the client side.
_Originally posted by @Tratcher in https://github.com/dotnet/aspnetcore/pull/48595#discussion_r1237227779_
Contributor guide
Assessment
This issue has not been assessed yet.