search

udibo / oauth2_server

A standards compliant implementation of an OAuth 2.0 authorization server with PKCE support.
MIT License
21 stars 4 forks source link

Refactor and remove requireRefresh from getAccessToken #37

Closed KyleJune closed 2 years ago

KyleJune commented 2 years ago

I had some refresh logic on the authorization server when I shouldn't have. I've also improved the example to use accessToken and refreshToken cookies for first party client instead of using a session on all requests that has both the accessToken and refreshToken. The old way wasn't as secure. With this change, the refresh tokens are only sent over http when requests are made to a few specific endpoints.