30887016421
100%

Ran 04 Aug 2026 07:15AM UTC

Jobs 1

Files 48

Run time 1min

Badge

Embed ▾

Committed 04 Aug 2026 07:14AM UTC coverage: 97.203% (-0.3%) from 97.484%

Build # 30887016421

Build Type

push

github

Committed by

shakaran

Commit Message

feat: store the hash of a refresh token instead of the token

A refresh token gets its holder back into an account without a password, so a
copy of the table was a copy of everybody's credentials, next to the passwords
that are hashed for exactly that reason.

hash_tokens stores sha256$ and the hash. SHA-256 rather than a slow hash because
64 random bytes are not guessable, and deterministic because a refresh request
carries the token and nothing else, so the row has to be findable from it.

The recipe that has been going around since 2021 puts the token back on the
entity after saving so it can be returned to the client, which leaves it managed
and dirty: the next flush in the request writes the token back in the clear. I
reproduced that with the published subscriber. Here the value is read before
saving instead, so nothing has to be restored and there is nothing to write back.

It decorates the manager, so it wraps whichever backend is in use, a manager of
your own included. Turning it on signs nobody out: a token stored before is taken
as it is and rewritten hashed when used, until accept_stored_in_the_clear is
turned off.

Off by default, since getRefreshToken() then returns the stored hash.

Coverage Stats

1251 of 1287 relevant lines covered (97.2%)

18.27 hits per line

Coverage Regressions

Lines	Coverage	∆	File
4	91.84	0.53%	src/DependencyInjection/GesdinetJWTRefreshTokenExtension.php

Jobs

ID	Job ID	Ran	Files	Coverage
1	30887016421.1	04 Aug 2026 07:15AM UTC	48	97.2	GitHub Action Run

markitosgv / JWTRefreshTokenBundle / 30887016421
100%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 30887016421

markitosgv / JWTRefreshTokenBundle / 30887016421 100%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 30887016421

markitosgv / JWTRefreshTokenBundle / 30887016421
100%

README BADGES
x