| 404 | } |
| 405 | |
| 406 | func (ts *TokenTestSuite) TestRefreshTokenReuseRevocation() { |
| 407 | originalSecurity := ts.API.config.Security |
| 408 | |
| 409 | ts.API.config.Security.RefreshTokenRotationEnabled = true |
| 410 | ts.API.config.Security.RefreshTokenReuseInterval = 0 |
| 411 | |
| 412 | defer func() { |
| 413 | ts.API.config.Security = originalSecurity |
| 414 | }() |
| 415 | |
| 416 | refreshTokens := []string{ |
| 417 | ts.RefreshToken.Token, |
| 418 | } |
| 419 | |
| 420 | for i := 0; i < 3; i += 1 { |
| 421 | var buffer bytes.Buffer |
| 422 | require.NoError(ts.T(), json.NewEncoder(&buffer).Encode(map[string]interface{}{ |
| 423 | "refresh_token": refreshTokens[len(refreshTokens)-1], |
| 424 | })) |
| 425 | |
| 426 | req := httptest.NewRequest(http.MethodPost, "http://localhost/token?grant_type=refresh_token", &buffer) |
| 427 | req.Header.Set("Content-Type", "application/json") |
| 428 | |
| 429 | w := httptest.NewRecorder() |
| 430 | ts.API.handler.ServeHTTP(w, req) |
| 431 | |
| 432 | assert.Equal(ts.T(), http.StatusOK, w.Code) |
| 433 | |
| 434 | var response struct { |
| 435 | RefreshToken string `json:"refresh_token"` |
| 436 | } |
| 437 | |
| 438 | require.NoError(ts.T(), json.NewDecoder(w.Body).Decode(&response)) |
| 439 | |
| 440 | refreshTokens = append(refreshTokens, response.RefreshToken) |
| 441 | } |
| 442 | |
| 443 | // ensure that the 4 refresh tokens are setup correctly |
| 444 | for i, refreshToken := range refreshTokens { |
| 445 | _, anyToken, _, err := models.FindUserWithRefreshToken(ts.API.db, ts.Config.Security.DBEncryption, refreshToken, false) |
| 446 | require.NoError(ts.T(), err) |
| 447 | |
| 448 | token := anyToken.(*models.RefreshToken) |
| 449 | |
| 450 | if i == len(refreshTokens)-1 { |
| 451 | require.False(ts.T(), token.Revoked) |
| 452 | } else { |
| 453 | require.True(ts.T(), token.Revoked) |
| 454 | } |
| 455 | } |
| 456 | |
| 457 | // try to reuse the first (earliest) refresh token which should trigger the family revocation logic |
| 458 | var buffer bytes.Buffer |
| 459 | require.NoError(ts.T(), json.NewEncoder(&buffer).Encode(map[string]interface{}{ |
| 460 | "refresh_token": refreshTokens[0], |
| 461 | })) |
| 462 | |
| 463 | req := httptest.NewRequest(http.MethodPost, "http://localhost/token?grant_type=refresh_token", &buffer) |