Jakub Zych 3b22134292 feat: device list and revoke with the jti followed through refresh ...

GET /devices lists the caller's confirmed and used device sessions (PHP's
fields, device_name from the stored name or the user agent, is_current
for the session the request's token belongs to). DELETE /devices/{id}
marks the session revoked and blacklists the device token's jti for its
whole refresh window in one transaction. POST /refresh hands a used
session's jwt_jti over to the refreshed token (classes.HandOverDeviceJTI),
so a device that refreshed before the revoke is signed out too.

2026-10-26 10:19:25 +01:00

4.6 KiB

Raw Blame History

View Raw