Add refresh token rotation with session management and replay attack detection

[tjementum]

Summary & Motivation

Implement secure refresh token rotation with replay attack detection by introducing a new Session aggregate that tracks refresh token chains in the database. This addresses a security gap where refresh tokens were previously stateless JWTs without server-side validation, making it impossible to detect token reuse or revoke sessions.

• Add Session aggregate to track refresh token chains with version tracking and grace period support
• Implement replay attack detection that revokes the entire session when an outdated token is used outside the grace period
• Integrate session creation into login, signup, and tenant switch flows
• Add session revocation on logout
• Add API endpoint to retrieve active sessions for the current user
• Fix IP address forwarding in YARP by adding AddXForwarded() transform, ensuring client IP addresses are correctly captured in sessions

Grace period explained: When a refresh token is rotated, the previous token version remains valid for a 30-second grace period. This handles parallel requests where multiple API calls may use the same refresh token simultaneously. If request A triggers a token refresh while request B is still in flight with the old token, request B can still complete successfully within the grace period. Outside this window, using an old token is treated as a replay attack and the entire session is revoked, forcing re-authentication.

Downstream projects

Please note that this will invalidate all existing refresh tokens, and all users will be logged out after deploying this.

If the default HTTP request timeout (DEFAULT_TIMEOUT in shared-webapp/infrastructure/http/httpClient.ts) has been extended beyond 30 seconds, also increase GracePeriodSeconds in account-management/Core/Features/Authentication/Domain/Session.cs to match. These values must stay in sync to prevent legitimate parallel requests from being incorrectly flagged as replay attacks.

Checklist

• I have added tests, or done manual regression tests
• I have updated the documentation, if necessary

[linear]

PP-204 Backend for refresh token rotation management

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
8 Accepted issues

Measures
0 Security Hotspots
82.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Approve Database Migration account-management database on stage

The following pending migration(s) will be applied to the database when approved:

• AddSessions (20260106041044_AddSessions)

Migration Script

BEGIN TRANSACTION;
IF NOT EXISTS (
    SELECT * FROM [__EFMigrationsHistory]
    WHERE [MigrationId] = N'20260106041044_AddSessions'
)
BEGIN
    CREATE TABLE [Sessions] (
        [TenantId] bigint NOT NULL,
        [Id] varchar(32) NOT NULL,
        [UserId] varchar(32) NOT NULL,
        [CreatedAt] datetimeoffset NOT NULL,
        [ModifiedAt] datetimeoffset NULL,
        [RefreshTokenJti] varchar(32) NOT NULL,
        [PreviousRefreshTokenJti] varchar(32) NULL,
        [RefreshTokenVersion] int NOT NULL,
        [DeviceType] varchar(20) NOT NULL,
        [UserAgent] nvarchar(500) NOT NULL,
        [IpAddress] varchar(45) NOT NULL,
        [RevokedAt] datetimeoffset NULL,
        [RevokedReason] varchar(20) NULL,
        CONSTRAINT [PK_Sessions] PRIMARY KEY ([Id]),
        CONSTRAINT [FK_Sessions_Tenants_TenantId] FOREIGN KEY ([TenantId]) REFERENCES [Tenants] ([Id]),
        CONSTRAINT [FK_Sessions_Users_UserId] FOREIGN KEY ([UserId]) REFERENCES [Users] ([Id]) ON DELETE CASCADE
    );
END;

IF NOT EXISTS (
    SELECT * FROM [__EFMigrationsHistory]
    WHERE [MigrationId] = N'20260106041044_AddSessions'
)
BEGIN
    CREATE INDEX [IX_Sessions_TenantId] ON [Sessions] ([TenantId]);
END;

IF NOT EXISTS (
    SELECT * FROM [__EFMigrationsHistory]
    WHERE [MigrationId] = N'20260106041044_AddSessions'
)
BEGIN
    CREATE INDEX [IX_Sessions_UserId] ON [Sessions] ([UserId]);
END;

IF NOT EXISTS (
    SELECT * FROM [__EFMigrationsHistory]
    WHERE [MigrationId] = N'20260106041044_AddSessions'
)
BEGIN
    INSERT INTO [__EFMigrationsHistory] ([MigrationId], [ProductVersion])
    VALUES (N'20260106041044_AddSessions', N'10.0.1');
END;

COMMIT;
GO