Rotate refresh-tokens on sstamp reset #12

Closed
opened 2026-04-05 20:28:55 +02:00 by MrUnknownDE · 0 comments
Owner

Originally created by @BlackDex on 3/29/2026

When a security-stamp gets reset/rotated we should also rotate all device refresh-tokens to invalidate them. Else clients are still able to use old refresh tokens.

*Originally created by @BlackDex on 3/29/2026* When a security-stamp gets reset/rotated we should also rotate all device refresh-tokens to invalidate them. Else clients are still able to use old refresh tokens.
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github/vaultwarden#12