Improve example's refresh token code to prevent session getting revoked

udibo / oauth2_server

A standards compliant implementation of an OAuth 2.0 authorization server with PKCE support.

MIT License

21 stars 4 forks source link

Improve example's refresh token code to prevent session getting revoked #23

Closed KyleJune closed 3 years ago

KyleJune commented 3 years ago

Currently there is no locking in getAccessToken around the refresh token code. If 2 requests come in at the same time, this could result in the token api being called twice for the same refresh token. That would cause the token to get revoked due to token replay prevention measures.