ENGINEERING INDEX / ENTRY 18
CASE 18 / SESSION SECURITY / REUSE RESPONSE
A replayed token closes the session family.
A stolen old refresh token should not quietly work after a legitimate device rotates its credential.
Source project: A Place to Show UpFocused security tests passedReviewed September 25, 2026
What happens if an old refresh token is replayed after rotation?
02 / THE SYSTEM
Where the handoffs happen.
The tested auth path rejects replay, revokes the entire refresh family including the newer token, and records a reuse-detection audit action. The legitimate user must log in again.
- 01Issue refresh family
- 02Rotate token
- 03Detect old-token reuse
- 04Revoke family and audit
What the record earns.
Rotation, replay detection, family revocation, and audit tested.
- Observed receipt
- On September 25, 2026, APTSU authz-matrix tests passed within a 33-test integration/security batch, including refresh rotation and reuse detection.
- Source and scope
- APTSU app/core/auth.py and tests/security/test_authz_matrix.py; dirty checkout HEAD 930369a at inspection.
04 / THE LIMIT
What this does not prove.
Local tests do not establish device compromise handling, provider-level revocation, or a security assessment of the complete deployed authentication surface.
Where the work goes next.
Rehearse a real client refresh/reuse sequence and verify audit visibility, user recovery, and rate limits.