- First commit to issue fork.
- @kksandr opened merge request.
- Status changed to Needs review
about 1 year ago 11:22pm 3 November 2023
It would be great to have a means to disable the refresh token rotation which is optional in the spec. The oauth2-server leaves it up to the implementation to do this, see this discussion.
My reasons are similar to others facing this issue - mostly poor client network connection that leads to dropping new refresh tokens upon access_token refresh.
As a suggestion, we could add an extra setting to enable this and then use it when revoking the old token in RefreshTokenRepository.php:33
public function revokeRefreshToken($token_id) {
// check the setting here
$this->revoke($token_id);
}
What do you think?
Cheers
Needs review
5.2
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.