Skip to content

Refresh Token Rotation #96

@Besthope-Official

Description

@Besthope-Official

Use Case

in /refresh endpoint, every time client request a new access token, a new refresh token is provided

why it matters:

  • a leaked refresh token stays valid for its full TTL, now make it single-use
  • better practice in client

Related PR

#20

Proposed Solution

invalidate the former one, and pass new refresh token to client

Alternatives Considered

N/A

Implementation Notes

use fastapi-users

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions