6 Commits

Author	SHA1	Message	Date
Trong Huu Nguyen	db391a9e44	refactor(session/store): consolidate session errors and use multi-error wrapping	2023-02-21 10:06:44 +01:00
Trong Huu Nguyen	ed56aac3d0	style: follow conventions for error variable names	2022-09-19 08:41:23 +02:00
Trong Huu Nguyen	c0138f4b49	feat(session): use locks for refreshing ... One of the changes in OAuth 2.1 addresses attacks with refresh token replays by recommending the use of one-time use tokens. A refresh token is thus rotated and invalid after exactly one use, returning a new token for each successful grant. Any further attempts must thus use the most recently acquired refresh token. Reusing a refresh token may also cause the authorization server to invalidate the current active refresh token, requiring a refresh authorization grant to be reacquired for further refresh token usage. The use of locks prevents multiple refresh grant attempts for a given session from happening across concurrent requests.	2022-09-04 17:14:35 +02:00
Trong Huu Nguyen	c78674e54a	fix(session/store): check for existence before update	2022-09-03 16:48:37 +02:00
Trong Huu Nguyen	d5bbca9897	feat: rudimentary support for refresh tokens	2022-08-26 14:32:39 +02:00
Trong Huu Nguyen	5990e4bb71	refactor(session): extract session handler	2022-08-19 11:44:13 +02:00