Granting a new refresh_token when refreshing a token about oauth2-server-php

[bshaffer]

According to the spec, the refresh_token grant type MAY issue a new refresh token:

 The authorization server MAY issue a new refresh token, in which case
 the client MUST discard the old refresh token and replace it with the
 new refresh token.  

As a result, I've added the option always_issue_new_refresh_token (defaults to FALSE) in the OAuth2_GrantType_RefreshToken class. So, by default a new refresh token is not issued, but you can easily configure this to do so.

I am open to changing the default to TRUE

[dsquier]

This is perfect, thanks much!

On Friday, January 11, 2013, Brent Shaffer wrote:

According to the spechttp://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-6,
the refresh_token grant type MAY issue a new refresh token:

The authorization server MAY issue a new refresh token, in which case
the client MUST discard the old refresh token and replace it with the
new refresh token.

As a result, I've added the option always_issue_new_refresh_token(defaults to FALSE) in the
OAuth2_GrantType_RefreshToken class. So, by default a new refresh token
is not issued, but you can easily configure this to do so.

I am open to changing the default to TRUE

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/22#issuecomment-12164033.