Refresh token survives logout
Logout often clears the browser cookie or the access token and leaves the refresh token, or the refresh family, valid. Password change and log-out-everywhere are the same test: the server must revoke the refresh chain, not only the cookie in front of you. If…
Tags: session, refresh, logout, ato
Typical severity: P3-P4
What it becomes
Low alone when the refresh token is short-lived and device-bound, and it becomes a session that outlives logout when refresh still mints a new access token.
Where to look
logout and revoke endpointsrefresh and rotation endpointspassword change and log-out-everywhere
Chains
- Session survives logout: After logout on an account you own, the refresh token still returns a new access token.
- Session survives password change: A refresh token issued before the password change, or before log-out-everywhere, is still accepted.
Notes
- Use two sessions you own. Do not keep a token taken from another person.
- A rotating refresh token that invalidates the presented token on logout is doing the right thing. Show the call that still succeeds.