Class DefaultRefreshTokenStore

Namespace

Fdyay.IdentityServer.Services.Tokens

Assembly

Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DefaultRefreshTokenStore : IRefreshTokenStore

Inheritance

object

DefaultRefreshTokenStore

Implements

IRefreshTokenStore

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

DefaultRefreshTokenStore(IPersistedGrantStore, TimeProvider, IHandleGenerationService)

A refresh token store over store.

public DefaultRefreshTokenStore(IPersistedGrantStore store, TimeProvider time, IHandleGenerationService handles)

Parameters

store IPersistedGrantStore

The persisted grant store the refresh tokens are kept in, keyed by the handle's hash.

time TimeProvider

The clock a refresh token's expiry is checked against.

handles IHandleGenerationService

What mints each refresh token's handle.

Methods

ConsumeRefreshTokenAsync(string, CancellationToken)

Marks a token rotated-away, keeping the row so a later presentation is recognisable.

public Task ConsumeRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

cancellationToken CancellationToken

Returns

Task

GetRefreshTokenAsync(string, CancellationToken)

Gets a refresh token, consumed or not, or null if it is absent or expired.

public Task<RefreshToken?> GetRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

cancellationToken CancellationToken

Returns

Task<RefreshToken>

Remarks

A consumed token comes back rather than reading as absent, because the caller has to be able to tell a replayed handle from one that was never issued. ConsumedTime says which.

RemoveFamilyAsync(string, string, string, CancellationToken)

Removes every refresh token in one lineage.

public Task RemoveFamilyAsync(string subjectId, string clientId, string familyId, CancellationToken cancellationToken = default)

Parameters

subjectId string

clientId string

familyId string

cancellationToken CancellationToken

Returns

Task

RemoveRefreshTokenAsync(string, CancellationToken)

Removes the refresh token a handle names.

public Task RemoveRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

The handle the client presented.

cancellationToken CancellationToken

Cancels the removal.

Returns

Task

StoreRefreshTokenAsync(RefreshToken, CancellationToken)

Stores a refresh token under a new handle and returns the handle.

public Task<string> StoreRefreshTokenAsync(RefreshToken token, CancellationToken cancellationToken = default)

Parameters

token RefreshToken

The token's contents; it is stored as not yet consumed.

cancellationToken CancellationToken

Cancels the write.

Returns

Task<string>

The handle — the refresh_token value the client is given.

TryConsumeRefreshTokenAsync(string, CancellationToken)

Marks a token rotated-away, saying whether this call is the one that consumed it.

public Task<bool> TryConsumeRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

The handle the client presented.

cancellationToken CancellationToken

Cancels the write.

Returns

Task<bool>

True when this call consumed the token; false when it was gone or already consumed.

Remarks

What a one-time refresh token is redeemed by, so of two requests presenting it at the same moment only one is answered (ours, security, 0.176.0). The default store consumes in one step through TryConsumeAsync(string, DateTime, CancellationToken); this default, for a store of a host's own written before 0.176.0, consumes and answers true, as before.

TryRemoveRefreshTokenAsync(string, CancellationToken)

Removes the refresh token a handle names, saying whether this call is the one that removed it.

public Task<bool> TryRemoveRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

The handle the client presented.

cancellationToken CancellationToken

Cancels the removal.

Returns

Task<bool>

True when the token was there and this call removed it; false when it was already gone.

Remarks

TryConsumeRefreshTokenAsync(string, CancellationToken)'s counterpart under PersistentGrantOptions.DeleteOneTimeOnlyRefreshTokensOnUse. The default store removes in one step through TryRemoveAsync(string, CancellationToken); this default removes and answers true, as before.

UpdateRefreshTokenAsync(string, RefreshToken, CancellationToken)

Rewrites what a live handle holds, keeping its row and consumed marker; its expiry follows the token's lifetime.

public Task UpdateRefreshTokenAsync(string handle, RefreshToken token, CancellationToken cancellationToken = default)

Parameters

handle string

token RefreshToken

cancellationToken CancellationToken

Returns

Task

Remarks

For a refresh token that is reused rather than rotated: its handle stays, so what changes on a refresh — the access token kept with it, and a sliding token's lifetime — is written back under the same one, the expiry as CreationTime plus Lifetime, as Duende 8.0.1's DefaultRefreshTokenStore.UpdateRefreshTokenAsync writes it. A handle that is gone stays gone.

Until 0.174.0 the default kept the row's expiry, and a reused sliding token never slid. A store of a host's own written to that contract keeps working and keeps that: its reused sliding tokens expire at their first lifetime.