I have a scenario where a user has a refresh token. As that token is getting ready to expire, the client sends the refresh token to the auth server to get a new refresh token. This usually happens on mobile devices and sometimes the response is not received - the connection is dropped or the browser is closed.

At this time, the user still has the old refresh token which is getting ready to expire.

Also, since the auth server has issued a new token, the auth server gives the client 5 minutes to retry, and then revokes the old token if it hasn't heard anything.

When the user opens his browser up again, he finds that he is logged out because he did not receive the new token, and the old token has been revoked.

Obviously to fix this, I could not revoke the old token, or give it more time like 24 hours before it's revoked. Is there any security risk in doing this? It means that there are two refresh tokens, but I guess if the refresh tokens can only be used with the auth server, then the auth server could revoke the other if either are used to try to get a new refresh token. Is that normal?

  • 1
    Maybe require a handshake from the client to confirm that it received the new token and only complete the refresh on the server side once the handshake is received. – Twilite Oct 20 '17 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.