Refresh reuse interval and reuse detection

[pverheggen]

Refresh tokens can be reused multiple times within a certain window after their first use, configured by the ttl.refreshReuse option.

Also adds a ttl.refreshRetention option, which sets the number of seconds after the reuse interval to retain for reuse detection.

[changeset-bot]

🦋 Changeset detected

Latest commit: a8c3a7f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@openauthjs/openauth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[thdxr]

cool! we definitely need to do this. only gave it a cursory look but in my head i imagined rewriting the refresh token back to the store with a new expiry so it would be cleaned up eventually

does that make sense at all?

[pverheggen]

cool! we definitely need to do this. only gave it a cursory look but in my head i imagined rewriting the refresh token back to the store with a new expiry so it would be cleaned up eventually

does that make sense at all?

Yup, that's currently the way it works. The new expiry is determined by (refreshReuse + refreshRetention), so 60s by default. The reason refreshRetention gets added to the expiry is so that it can be kept around for reuse detection, which is supposed to mitigate replay attacks.

I made some more updates since the previous draft, and think it's good to go now:

• JSDoc strings and comments where appropriate
• Unit tests
• Renamed "leeway" to "reuse interval". Apparently leeway is unrelated and has to do with clock skew (at least how Auth0 defines it.)
• Fixed a bug with token invalidation that I ran into, described in the changeset. If that fix needs more discussion, I could split that out into a separate PR.

[mwood23]

This is an amazing addition, thank you @pverheggen for putting in the work on this. OpenAuth isn't really usable in a SPA without it.

[thdxr]

thank you for the contribution! made some minor tweaks to match some naming conventions we have but great