Solving appropriate the Client Side RefreshToken Race Issue about node-oauth2-server

[Uzlopak]

See also
https://hackerone.com/reports/55140

The refreshTokenExpirationDelay could be named alwaysIssueNewRefreshTokenGracePeriod

[jorenvandeweyer]

The library already handles this issue if the user implements the revokeToken function correctly.

node-oauth2-server/lib/grant-types/refresh-token-grant-type.js

Lines 45 to 59 in f460371

	async handle(request, client) {
	if (!request) {
	throw new InvalidArgumentError('Missing parameter: `request`');
	}
	if (!client) {
	throw new InvalidArgumentError('Missing parameter: `client`');
	}
	let token;
	token = await this.getRefreshToken(request, client);
	token = await this.revokeToken(token);
	return this.saveToken(token.user, client, token.scope);
	}

node-oauth2-server/lib/grant-types/refresh-token-grant-type.js

Lines 114 to 118 in f460371

	const status = await this.model.revokeToken(token);
	if (!status) {
	throw new InvalidGrantError('Invalid grant: refresh token is invalid or could not be revoked');
	}

As you can see in the code snippets above, when the function revokeToken of the model fails, the whole refresh call fails.

This is already included in the docs:

node-oauth2-server/docs/model/spec.rst

Lines 778 to 781 in f460371

	**Return value:**
	Return ``true`` if the revocation was successful or ``false`` if the refresh token could not be found.