From 4e73f39f57e3b169cc45a961442f2f7f5624ea1e Mon Sep 17 00:00:00 2001 From: "m.nabokikh" Date: Mon, 11 Jan 2021 14:06:31 +0400 Subject: [PATCH] Do not refresh id token claims if refresh token is allowed to reuse Signed-off-by: m.nabokikh --- server/refreshhandlers.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/server/refreshhandlers.go b/server/refreshhandlers.go index 31709ad5..311eb30a 100644 --- a/server/refreshhandlers.go +++ b/server/refreshhandlers.go @@ -91,6 +91,7 @@ func (s *Server) getRefreshTokenFromStorage(clientID string, token *internal.Ref s.logger.Errorf("refresh token with id %s expired", refresh.ID) return storage.RefreshToken{}, &rerr } + if s.refreshTokenPolicy.ExpiredBecauseUnused(refresh.LastUsed) { s.logger.Errorf("refresh token with id %s expired because being unused", refresh.ID) return storage.RefreshToken{}, &rerr @@ -131,7 +132,7 @@ func (s *Server) getRefreshScopes(r *http.Request, refresh *storage.RefreshToken return requestedScopes, nil } -func (s *Server) refreshWithConnector(ctx context.Context, refresh *storage.RefreshToken, scopes []string) (connector.Identity, *refreshError) { +func (s *Server) refreshWithConnector(ctx context.Context, token *internal.RefreshToken, refresh *storage.RefreshToken, scopes []string) (connector.Identity, *refreshError) { var connectorData []byte rerr := refreshError{msg: errInvalidRequest, desc: "", code: http.StatusInternalServerError} @@ -166,6 +167,12 @@ func (s *Server) refreshWithConnector(ctx context.Context, refresh *storage.Refr ConnectorData: connectorData, } + // user's token was previously updated by a connector and is allowed to reuse + // it is excessive to refresh identity in upstream + if s.refreshTokenPolicy.AllowedToReuse(refresh.LastUsed) && token.Token == refresh.ObsoleteToken { + return ident, nil + } + // Can the connector refresh the identity? If so, attempt to refresh the data // in the connector. // @@ -272,7 +279,7 @@ func (s *Server) handleRefreshToken(w http.ResponseWriter, r *http.Request, clie return } - ident, rerr := s.refreshWithConnector(r.Context(), &refresh, scopes) + ident, rerr := s.refreshWithConnector(r.Context(), token, &refresh, scopes) if rerr != nil { s.refreshTokenErrHelper(w, rerr) return