Add refresh-tokens module: JWT refresh token rotation, token families and reuse detection on Spring Security 7.1

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b6XzpJxZ25cDyuw1Uk
2026-11-15 01:19:11 +05:30
parent 760fbc2d09
commit 13e8de2193
41 changed files with 1575 additions and 0 deletions
@@ -0,0 +1,17 @@
+$ curl -X POST /api/auth/login  (alice)
+{"access_token":"eyJraWQiOiJMeX...","refresh_token":"FeHO52BY0danWV...","token_type":"Bearer","expires_in":300}
+
+$ curl /api/me  (Bearer access token)
+{"sub":"alice","sid":"c9ddb06a..."}
+HTTP 200
+
+$ curl -X POST /api/auth/refresh  (token A)
+{"access_token":"eyJraWQiOiJMeX...","refresh_token":"zgB_rx1Kaqu_AZ...","token_type":"Bearer","expires_in":300}
+
+$ curl -X POST /api/auth/refresh  (token A again: the replay)
+{"error":"invalid_grant","error_description":"The refresh token is not valid"}
+HTTP 401
+
+$ curl -X POST /api/auth/refresh  (token B, the innocent holder)
+{"error":"invalid_grant","error_description":"The refresh token is not valid"}
+HTTP 401