Refresh token rotation
Open
complexity: large
feature: Login
role: Back End
size: 2pt
- Dominant language
- JavaScript
- Stars
- 61
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
### Overview
User Story:
As a security-conscious system, I want refresh tokens rotated so stolen refresh tokens are less useful.
### Action Items
Acceptance Criteria:
- [ ] On every successful refresh:
- [ ] backend issues new refresh token and invalidates the previous one (server-side)
- [ ] refresh token cookie is updated
- [ ] If an old refresh token is reused after rotation, backend detects reuse and revokes the session family.
### Resources/Instructions
- This issue is part of the epic: #2065
Contributor guide
Assessment
This issue has not been assessed yet.