Andras/BoundlessFlowCampus2K
4
7
Fork 0
Code Issues 90 Pull requests 7 Projects Releases Packages Wiki Activity Actions

Improve refresh token security in Login service #1245

New issue
Open
opened 2026-05-29 11:32:54 +00:00 by c24elipe · 0 comments
c24elipe commented 2026-05-29 11:32:54 +00:00
Collaborator
Copy link

Today, a refresh token is removed and or written over in the database on a logout or a refresh.
A more secure method would have been to save each token (for as long as they would be within there life time), and assign each a token family (a shared ID).

This way, an extra security check could be done to check if the token was re-given again later (outside a recommended grace period of 10-30 seconds). For if it happens, then we can't know if each request is made from a hijacker of the account or the actual user. The best thing to do if that happens is to simply log the user out of everything.

The grace period is because if the user has a bad internet connection, the request can then be sent twice or more times.

Today, a refresh token is removed and or written over in the database on a logout or a refresh. A more secure method would have been to save each token (for as long as they would be within there life time), and assign each a token family (a shared ID). This way, an extra security check could be done to check if the token was re-given again later (outside a recommended grace period of 10-30 seconds). For if it happens, then we can't know if each request is made from a hijacker of the account or the actual user. The best thing to do if that happens is to simply log the user out of everything. The grace period is because if the user has a bad internet connection, the request can then be sent twice or more times.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
#1236-edit-mode-txt
#1229-generic-themed-buttons
Add-an-option-to-set-no-image-to-image-view-1227
#1242-prog-bar-colors-fix
#1239-Remove-Vertical-Scroll
Image-view-error-1230
Make-the-card-title-and-header-of-card-uniform-1233
both_teams_week_8
team_2_week_7
team_1_week_7
temp_branch_week_7
team_2_week_6
team_1_week_6
team_2_week_5
team_1_week_5
temp_branch_week_5
team_2_week_4
team_1_week_4
week_4_temp_branch
temp-branch-week-3
team_2_week_3
team_1_week_3
team_2_week_2
team_1_week_2
temp-week-2-merge-branch
team_2_week_1
team_1_week_1
No results found.
Labels
Clear labels   
_CRITICAL_

Only use this label for critical tasks that are project-scope,and must be addressed ASAP.

  
API

   
app

   
backEnd

   
Blocked, waiting for further changes

   
bug

Something is not working

  
cleanup

Issues to cleanup the codebase (restructure folders, remove deprecated or smelly code)

  
close

Issue to close

  
design

   
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
feature request

   
frontEnd

   
help wanted

Need some help

  
invalid

Something is wrong

  
low priority

   
needs input

Issue needs input from product owner or customer

  
needs review

issue is in need of review

  
project documentation

   
question

More information is needed

  
research

   
reviewed

This Issue has been reviewed

  
script

   
security

use this for security-related issues

  
SQL

  
style

   
testing

   
topLevel

Reserved for top-level, project-wide issues.

  
wontfix

This won't be fixed

No labels
_CRITICAL_
API
app
backEnd
Blocked, waiting for further changes
bug
cleanup
close
design
duplicate
enhancement
feature request
frontEnd
help wanted
invalid
low priority
needs input
needs review
project documentation
question
research
reviewed
script
security
SQL
style
testing
topLevel
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Andras/BoundlessFlowCampus2K#1245
No description provided.