Class RefreshToken
- Namespace
- Fdyay.IdentityServer.Models
- Assembly
- Fdyay.IdentityServer.Core.dll
A refresh token that can be exchanged for new access/identity tokens.
public class RefreshToken- Inheritance
-
RefreshToken
- Inherited Members
Properties
AccessTokens
The access tokens issued with this refresh token, by the resource indicator each was issued for — the empty string for none.
public IDictionary<string, Token> AccessTokens { get; set; }Property Value
Remarks
Duende 8.0.1's, measured: a refresh hands the one kept for its indicator back, renewed, unless the client sets UpdateAccessTokenClaimsOnRefresh. Absent from tokens written before 0.99.0, whose first refresh builds one afresh and keeps it.
AuthorizedResourceIndicators
The APIs the grant was authorized for by resource indicator (RFC 8707); a token request on this refresh token may only name one of them. Empty means the authorization named none, and nothing is restricted.
public ICollection<string> AuthorizedResourceIndicators { get; set; }Property Value
Remarks
Duende distinguishes null (no authorization step) from an empty list; here both cases mean the same thing, because a grant whose authorization named no indicator is limited by its scopes and by nothing narrower.
Claims
The subject's claims captured at issuance.
public ICollection<Claim> Claims { get; set; }Property Value
ClientId
The client the token was issued to.
public string ClientId { get; set; }Property Value
ConsumedTime
When this token was rotated away, or null while it is the current one.
public DateTime? ConsumedTime { get; set; }Property Value
Remarks
Set once and never cleared. A consumed token is not merely spent: presenting one is the signal that a handle was captured, since the legitimate client has already exchanged it and holds the successor.
CreationTime
When the token was first issued (the sliding/absolute anchor, UTC).
public DateTime CreationTime { get; set; }Property Value
DPoPKeyThumbprint
The DPoP key this token is bound to, or null for a bearer refresh token (RFC 9449 §5).
public string? DPoPKeyThumbprint { get; set; }Property Value
Remarks
Bound at issue and checked at every use. Without it a refresh token obtained under DPoP would be the one bearer credential left in the flow — and the long-lived one, so stealing it would be worth more than stealing the access token the binding protects.
Description
The name the user gave this grant when approving it, for their list of grants. Duende's.
public string? Description { get; set; }Property Value
FamilyId
The lineage this token belongs to: one sign-in, and every token rotation has produced from it.
public string FamilyId { get; set; }Property Value
Remarks
Recorded rather than inferred. The same user can hold several live refresh tokens for the same client — a second browser, a phone — so subject and client do not identify a lineage, and revoking by those two on a replay would sign the user out everywhere instead of only where the theft happened.
IsOpenId
Whether the original request included the openid scope.
public bool IsOpenId { get; set; }Property Value
Lifetime
The current lifetime in seconds, measured from CreationTime.
public int Lifetime { get; set; }Property Value
Scopes
The granted scopes.
public ICollection<string> Scopes { get; set; }Property Value
SessionId
The session id, if any.
public string? SessionId { get; set; }Property Value
SubjectId
The subject id.
public string SubjectId { get; set; }Property Value
Methods
GetAccessToken(string?)
The access token kept for a resource indicator, or null when none is.
public Token? GetAccessToken(string? resourceIndicator = null)Parameters
resourceIndicatorstring
Returns
SetAccessToken(Token, string?)
Keeps an access token for a resource indicator, replacing the one kept before.
public void SetAccessToken(Token token, string? resourceIndicator = null)