Choose Sessions, JWTs, and Refresh Tokens by Threat Model

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

package com.example.security;

import org.springframework.stereotype.Service;
import java.time.Duration;
import java.time.Instant;
import java.util.Map;
import java.util.UUID;
import java.util.concurrent.ConcurrentHashMap;

@Service
public class JwtTokenRotationLab {
    public record TokenPair(String accessToken, String refreshToken, Instant expiresAt) {}

    // In-memory token family storage for rotation tracking
    private final Map<String, String> activeRefreshTokens = new ConcurrentHashMap<>();

    public TokenPair issueInitialTokens(String userId) {
        String accessToken = "jwt_access_" + UUID.randomUUID() + "_" + userId;
        String refreshToken = "rfr_" + UUID.randomUUID();
        activeRefreshTokens.put(refreshToken, userId);
        return new TokenPair(accessToken, refreshToken, Instant.now().plus(Duration.ofMinutes(15)));
    }

    public TokenPair rotateRefreshToken(String presentedRefreshToken) {
        String userId = activeRefreshTokens.remove(presentedRefreshToken);
        if (userId == null) {
            // Replay detected! Invalidate entire user session family
            throw new SecurityException("Refresh token reuse detected! Revoking token family.");
        }
        String newAccessToken = "jwt_access_" + UUID.randomUUID() + "_" + userId;
        String newRefreshToken = "rfr_" + UUID.randomUUID();
        activeRefreshTokens.put(newRefreshToken, userId);
        return new TokenPair(newAccessToken, newRefreshToken, Instant.now().plus(Duration.ofMinutes(15)));
    }
}