Refresh-Tokens on Hardcode Consulting https://blog.hardcodeconsulting.tech/tags/refresh-tokens/ Recent content in Refresh-Tokens on Hardcode Consulting Hardcode Consulting https://blog.hardcodeconsulting.tech/favicon.svg https://blog.hardcodeconsulting.tech/favicon.svg Hugo -- 0.167.0 en Sun, 09 Aug 2026 18:00:00 +0530 The Day Two Security Features Cancelled Out https://blog.hardcodeconsulting.tech/post/when-two-security-features-collide/ Sun, 09 Aug 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/when-two-security-features-collide/ Session branching and per request signing were both correct. Shipped together they made the recovery path unreachable by the only client that needed it. Branch the Session Instead of Narrowing It https://blog.hardcodeconsulting.tech/post/session-branching-instead-of-narrowing/ Sun, 26 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/session-branching-instead-of-narrowing/ A refresh that cannot prove its device should not touch the session it was presented against. Insert a new row, and let the real client collapse the rest. Binding a Refresh Token to the Device https://blog.hardcodeconsulting.tech/post/binding-refresh-tokens-to-the-device/ Sun, 19 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/binding-refresh-tokens-to-the-device/ A refresh token anybody can replay is a bearer secret. Binding it to a non-extractable WebCrypto key makes a copied token useless on its own. Dropping Reuse Detection Gave Two People One Session https://blog.hardcodeconsulting.tech/post/refresh-token-reuse-detection-tradeoff/ Sun, 12 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/refresh-token-reuse-detection-tradeoff/ Removing refresh token reuse detection looked like a small trade. It quietly lets a thief and the real user converge on one live pair, permanently. Refresh Token Rotation With a Previous Pair https://blog.hardcodeconsulting.tech/post/refresh-token-rotation-previous-pair/ Sun, 28 Jun 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/refresh-token-rotation-previous-pair/ Single use refresh tokens log people out when a response is lost. Keeping a previous pair on the session row fixes it without reopening unlimited minting. Your JWT Was Never Stateless https://blog.hardcodeconsulting.tech/post/jwt-was-never-stateless/ Sun, 21 Jun 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/jwt-was-never-stateless/ Every JWT system that must block a user ends up reading a database per request. Designing refresh token rotation around that, not against it.