Repository navigation
Refresh token revoked before scope validation #390
Description
Specify your setup
- Operating System: Linux (Debian 12.12)
- Node version: 24.12.0
- npm version: N/A (using pnpm)
- version of @node-oauth/oauth2-server: 5.2.0
- which OAuth2 workflow: Refresh Token Grant (RFC 6749 Section 6)
- at which workflow step: Token refresh with scope parameter
Describe the bug
When refreshing a token with invalid scopes, the refresh token is revoked before scope validation. If validation fails, the token is destroyed without creating a replacement, permanently breaking authentication.
To Reproduce
- Issue refresh token without scope
- Client requests refresh with scope=some-scope
- revokeToken() destroys the token (line 57)
- getScope() throws InvalidScopeError (line 59)
- Client retries without scope
- Receives "Invalid grant: refresh token is invalid"
Expected behavior
Scope validation should occur before revocation. Invalid scope requests should fail without destroying the token.
Additional context
The fix is to swap lines 57 and 59 in lib/grant-types/refresh-token-grant-type.js to validate scope before revoking. Similar to issue #82 which addressed authorization code revocation timing.
Activity
fix(refresh-token): validate scope before revoking token node-oauth#390
jankapunkt commentedon Jan 7, 2026
Hey @runeb thank you very much for revealing this one. I will review tomorrow, please make sure to update the tests accordingly.
runeb commentedon Jan 7, 2026
@jankapunkt Thanks for the quick reply, I will add a test for this case
test(refresh-token): add test for extra scope validation node-oauth#390
runeb commentedon Jan 7, 2026
@jankapunkt I didn't find an existing test for testing invalid extra scope in refresh requests, so I made the test more generally about that, with assertions that revoke and save are not called on the model when returning "Invalid scope: Unable to add extra scopes"
jankapunkt commentedon Jan 12, 2026
Thanks @runeb
Merge pull request #389 from runeb/fix/validate-scope-before-revoke
jankapunkt commentedon Jan 12, 2026
@runeb this is merged and released in
5.2.2-rc.0please install vianpm i @node-oauth/oauth2-server@5.2.2-rc.0and let me know if anything unexpectedly breaks.runeb commentedon Jan 14, 2026
Thank you @jankapunkt . Our oauth server test suite passes on
5.2.2-rc.0tlangens commentedon Jun 11, 2026
@jankapunkt seems like #389 didn't make it into 5.3.0, any reason for that?
dhensby commentedon Jun 15, 2026
Thanks for the nudge @tlangens — you're right, and here's what happened.
The fix (#389) was merged into the
developmentbranch and released as5.2.2-rc.0, butdevelopmentwas never merged back intomaster.5.3.0was cut frommaster, so it shipped without the fix. In the meantimedevelopmenthad fallen ~47 commits behindmaster, which is why this slipped through.I've opened #441, which merges
developmentback intomaster(preserving @runeb's original commit) and resolves the divergence so the only net change againstmasteris the fix + its test. Full suite passes. Once that lands I'll cut a release and follow up here.Leaving this open until #441 is merged and released.
Merge development into master to recover lost #390 fix
Merge pull request #441 from dhensby/merge/development-into-master
tlangens commentedon Aug 3, 2026
@dhensby did you mean to cut a new release now that #441 is merged?
dhensby commentedon Aug 3, 2026
I can't make releases, but we should
tlangens commentedon Aug 4, 2026
@jankapunkt can we have a new release including the missing changes from #441 ?
trevorloranger commentedon Sep 30, 2026
@jankapunkt @dhensby : bumping the above request. Thank you 🙏 cc: @tlangens