Ensure Refresh Token Entity hasn't expired

2025-05-31 14:12:07 +05:30 · 2014-12-03 23:22:14 +00:00
parent b8331d12e4
commit f8b61b47b9
2 changed files with 76 additions and 3 deletions
--- a/src/Grant/RefreshTokenGrant.php
+++ b/src/Grant/RefreshTokenGrant.php
@@ -94,6 +94,11 @@ class RefreshTokenGrant extends AbstractGrant
            throw new Exception\InvalidRefreshException();
        }

+        // Ensure the old refresh token hasn't expired
+        if ($oldRefreshToken->isExpired() === true) {
+            throw new Exception\InvalidRefreshException();
+        }
+
        $oldAccessToken = $oldRefreshToken->getAccessToken();

        // Get the scopes for the original session