Jakub Zych cc3636cea9 fix: a device revoke cannot lose to a concurrent refresh ...

The revoke now reads the device's jti with UPDATE ... RETURNING under the
row lock, and the refresh's hand-over (classes.FollowDeviceJTI) reports a
session revoked meanwhile, so the refresh answers the blacklisted-token
401 without a token. A hand-over error fails the refresh closed instead
of leaving the session on a stale jti.

2026-10-26 16:00:43 +01:00

49 KiB

Raw Blame History

View Raw