thinktecture/Thinktecture.AuthorizationServer — pull request #159 by Excape (2014-03-03 15:33:51+00:00)
Title: Renew refresh token on every request / sliding refresh token expiration

According to the oAuth2 specification (http://tools.ietf.org/html/rfc6749#section-6) a new refresh token can be issued after a refresh token has been used. Currently, the same refresh token is given with the access token after the client requests a new, "refreshed" access token

Commit d65737b changes this. When a client requests a "refreshed" access token, a new refresh token gets generated (with the same expiration date) and the old one gets revoked. After that, the client has to use the new refresh token.

With commits 4ea77ba and 53ba484 , I implemented a sliding token expiration on the refresh token. After each request for a refreshed token, a new refresh token is issued, with the expiration extended to match the original expiration length. Thus, a refresh token expires only after the user has been inactive for the expiration time of the refresh token (This is what I asked with #141)

This sliding expiration behavior is configurable per application and can be set on the Manage Application view. (commit 53ba484)

This is my first Pull Request, I don't know wether you can pull single commits / changes or just the whole pull request. In that case I'd have to create sepperate pull requests