Skip to content

Feat/refresh token - #1

Merged
ahmadogo merged 2 commits into
ahmadogo:mainfrom
helenahelenavanbeek-png:feat/refresh-token
Jul 24, 2026
Merged

Feat/refresh token#1
ahmadogo merged 2 commits into
ahmadogo:mainfrom
helenahelenavanbeek-png:feat/refresh-token

Conversation

@helenahelenavanbeek-png

Copy link
Copy Markdown

Closes MentoNest#691

Changes Made

  • Added RefreshToken entity with device fingerprint support
  • Added RefreshTokenService for token lifecycle management
  • Added POST /auth/refresh endpoint
  • Implemented refresh token rotation (old token invalidated after use)
  • Added device info (user agent, IP) for audit logging
  • Added concurrent refresh detection with security alerts
  • Proper expiration handling (401 when expired)

Security Features

  • Token rotation: each refresh generates new token, invalidates old
  • Device fingerprint support
  • Concurrent refresh detection
  • Revoked/invalid tokens return 401 with clear message

Testing

  • Token rotation works correctly
  • Expired tokens return 401
  • Invalid tokens return 401
  • Device info stored in database

- Add RefreshToken entity for database storage
- Add RefreshTokenService for token management
- Add POST /auth/refresh endpoint
- Implement refresh token rotation for security
- Store device info (user agent, IP) with tokens
- Add concurrent refresh detection
- Add proper expiration handling (401 on expired tokens)

Fixes MentoNest#691
@ahmadogo
ahmadogo merged commit 18dec2e into ahmadogo:main Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Refresh token support

3 participants