Skip to content

Conversation

@runeb
Copy link

@runeb runeb commented Jan 7, 2026

Summary

Fixes token destruction when refresh requests include invalid scopes. Currently, revokeToken() is called before getScope() validation. If scope validation fails, the token is destroyed without replacement.

Linked issue(s)

Fixes #390

Involved parts of the project

lib/grant-types/refresh-token-grant-type.js - Reordered scope validation to occur before token revocation in the refresh token grant handler.

Added tests?

Yes. Added test in test/integration/grant-types/refresh-token-grant-type_test.js that verifies InvalidScopeError is thrown when extra scope is requested, and that revokeToken()/saveToken() are not called before validation.

OAuth2 standard

RFC 6749 Section 6 states: "The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client."

Current implementation revokes before validation, violating this guidance. The fix ensures revocation only occurs after successful scope validation.

Reproduction

  1. Issue refresh token without scope
  2. Request refresh with invalid scope (e.g., scope=unauthorized)
  3. Before fix: Token destroyed, retry fails with "invalid grant"
  4. After fix: Token preserved, retry succeeds

@runeb runeb changed the title fix(refresh-token): validate scope before revoking token #757 fix(refresh-token): validate scope before revoking token #390 Jan 7, 2026
@runeb runeb force-pushed the fix/validate-scope-before-revoke branch from 2f58648 to 4abe326 Compare January 7, 2026 21:17
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a critical bug where refresh tokens were being destroyed when scope validation failed. The fix reorders scope validation to occur before token revocation, ensuring tokens are only revoked after successful validation.

Changes:

  • Reordered scope validation to occur before token revocation in the refresh token grant handler
  • Added test coverage to verify that revokeToken() and saveToken() are not called when scope validation fails
  • Added inline comment explaining the reason for the reordering

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
lib/grant-types/refresh-token-grant-type.js Moved getScope() call before revokeToken() to prevent token destruction on scope validation errors
test/integration/grant-types/refresh-token-grant-type_test.js Added test to verify InvalidScopeError is thrown and token operations are not called when extra scope is requested

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@jankapunkt jankapunkt merged commit c476e4c into node-oauth:development Jan 12, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants