Add refresh-tokens module: JWT refresh token rotation, token families and reuse detection on Spring Security 7.1

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b6XzpJxZ25cDyuw1Uk
2026-11-15 01:19:11 +05:30
parent 760fbc2d09
commit 13e8de2193
41 changed files with 1575 additions and 0 deletions
@@ -0,0 +1,9 @@
+alice logs in and gets refresh token A.
+An attacker copies A out of a log file.
+alice's app refreshes: A -> B (A is now USED).
+the attacker replays A: HTTP 401 {"error":"invalid_grant","error_description":"The refresh token is not valid"}
+the family after the replay:
+  token A   hash 7131712c  status REVOKED
+  token B   hash 1c626483  status REVOKED
+alice's app now presents B: HTTP 401  (the innocent holder is signed out too)
+B's access token on /api/me, no sid check: HTTP 200 (still inside its 5 minutes)