Golang Microservices Full Course #19 - Refresh Token Rotation & Token Reuse Detection

Summary

The tutorial implements refresh-token rotation and reuse detection in a Go wallet application’s JWT authentication flow.

Token lifetimes

Access tokens last 15 minutes, while refresh tokens last seven days. A valid refresh token can be used to obtain a new access token.

Refresh-token storage

The presenter adds a database migration and model for refresh tokens, including the user ID, token, expiry, revocation status, and timestamps. Repository operations support creating and finding tokens, revoking individual tokens, and revoking all tokens for a user.

Rotation and reuse detection

When a refresh request succeeds, the service checks and validates the token in the database. It issues a new access token and refresh token, revokes the old refresh token, and stores the new one. Login is also updated to save the refresh token.

If a revoked refresh token is presented again, the system treats it as possible token theft and revokes all active refresh tokens for that user. This logs out both the legitimate user and anyone attempting to reuse the token.

Session handling and testing

The tutorial adds a refresh endpoint and updates logout and password-reset handling to revoke refresh tokens. The presenter tests the flow with API requests and database checks, confirming that a refresh produces a different token and that reuse of the old token triggers revocation.

Overall, this hands-on guide covers database changes, Go models and repositories, service logic, handlers, routing, and manual testing.

Main speaker/source: Course presenter Ikhda Muhammad Wildani.