Token has been revoked (refreshSession)

[seboslaw]

When doing a refreshSession I get this error occasionally. I don't know how to reproduce it, but today I debugged in a session this morning until 11am, then let the Simulator rest and fired it up again at 10pm. The app then tried to call refreshSession with the refreshToken (which was still valid), but the API returned "Token has been revoked". I have no idea what parameters cause this situation.

[seboslaw]

@dholms @ericvolp12 do you have any idea why this might happen?

[devinivy]

It's hard to know for sure without some more context, but my hunch is that it's related to "forking" a refresh token. For example, say you call server.refreshSession twice using the same refresh token, and receive two new refresh tokens. Only the last of the two new refresh tokens will remain valid, while the first will get revoked. This prevents a bad actor from forking a single refresh token into arbitrarily many new tokens.

[seboslaw]

Hm, that was my first hunch as well and thus I started queuing my calls. But then I found this section which says - if I understand the code correctly - there is a 2hrs grace period in which you can call the refreshSession endpoint with an outdated refreshToken and still receive a new refreshToken (which will be the same every time):

atproto/packages/pds/src/account-manager/index.ts

Line 240 in 9fd65ba

const graceExpiresAt = new Date(now.getTime() + REFRESH_GRACE_MS)

[seboslaw]

@devinivy can you confirm this?