Interface IRefreshTokenStore

Namespace

Fdyay.IdentityServer.Services.Tokens

Assembly

Fdyay.IdentityServer.Core.dll

Stores and retrieves refresh tokens.

public interface IRefreshTokenStore

Methods

ConsumeRefreshTokenAsync(string, CancellationToken)

Marks a token rotated-away, keeping the row so a later presentation is recognisable.

Task ConsumeRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

cancellationToken CancellationToken

Returns

Task

GetRefreshTokenAsync(string, CancellationToken)

Gets a refresh token, consumed or not, or null if it is absent or expired.

Task<RefreshToken?> GetRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

cancellationToken CancellationToken

Returns

Task<RefreshToken>

Remarks

A consumed token comes back rather than reading as absent, because the caller has to be able to tell a replayed handle from one that was never issued. ConsumedTime says which.

RemoveFamilyAsync(string, string, string, CancellationToken)

Removes every refresh token in one lineage.

Task RemoveFamilyAsync(string subjectId, string clientId, string familyId, CancellationToken cancellationToken = default)

Parameters

subjectId string

clientId string

familyId string

cancellationToken CancellationToken

Returns

Task

RemoveRefreshTokenAsync(string, CancellationToken)

Removes the refresh token a handle names.

Task RemoveRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

The handle the client presented.

cancellationToken CancellationToken

Cancels the removal.

Returns

Task

StoreRefreshTokenAsync(RefreshToken, CancellationToken)

Stores a refresh token under a new handle and returns the handle.

Task<string> StoreRefreshTokenAsync(RefreshToken token, CancellationToken cancellationToken = default)

Parameters

token RefreshToken

The token's contents; it is stored as not yet consumed.

cancellationToken CancellationToken

Cancels the write.

Returns

Task<string>

The handle — the refresh_token value the client is given.

TryConsumeRefreshTokenAsync(string, CancellationToken)

Marks a token rotated-away, saying whether this call is the one that consumed it.

Task<bool> TryConsumeRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

The handle the client presented.

cancellationToken CancellationToken

Cancels the write.

Returns

Task<bool>

True when this call consumed the token; false when it was gone or already consumed.

Remarks

What a one-time refresh token is redeemed by, so of two requests presenting it at the same moment only one is answered (ours, security, 0.176.0). The default store consumes in one step through TryConsumeAsync(string, DateTime, CancellationToken); this default, for a store of a host's own written before 0.176.0, consumes and answers true, as before.

TryRemoveRefreshTokenAsync(string, CancellationToken)

Removes the refresh token a handle names, saying whether this call is the one that removed it.

Task<bool> TryRemoveRefreshTokenAsync(string handle, CancellationToken cancellationToken = default)

Parameters

handle string

The handle the client presented.

cancellationToken CancellationToken

Cancels the removal.

Returns

Task<bool>

True when the token was there and this call removed it; false when it was already gone.

Remarks

TryConsumeRefreshTokenAsync(string, CancellationToken)'s counterpart under PersistentGrantOptions.DeleteOneTimeOnlyRefreshTokensOnUse. The default store removes in one step through TryRemoveAsync(string, CancellationToken); this default removes and answers true, as before.

UpdateRefreshTokenAsync(string, RefreshToken, CancellationToken)

Rewrites what a live handle holds, keeping its row and consumed marker; its expiry follows the token's lifetime.

Task UpdateRefreshTokenAsync(string handle, RefreshToken token, CancellationToken cancellationToken = default)

Parameters

handle string

token RefreshToken

cancellationToken CancellationToken

Returns

Task

Remarks

For a refresh token that is reused rather than rotated: its handle stays, so what changes on a refresh — the access token kept with it, and a sliding token's lifetime — is written back under the same one, the expiry as CreationTime plus Lifetime, as Duende 8.0.1's DefaultRefreshTokenStore.UpdateRefreshTokenAsync writes it. A handle that is gone stays gone.

Until 0.174.0 the default kept the row's expiry, and a reused sliding token never slid. A store of a host's own written to that contract keeps working and keeps that: its reused sliding tokens expire at their first lifetime.