Revoke tokens when authorization code replay is detected (RFC 6749 Section 10.5)

[leodip]

Summary

Implement token revocation when multiple attempts to exchange the same authorization code are detected, as recommended by RFC 6749 Section 10.5.

Background

RFC 6749 Section 10.5 states:

If the authorization server observes multiple attempts to exchange an authorization code for an access token, the authorization server
SHOULD attempt to revoke all access tokens already granted based on the compromised authorization code.

This is a defense-in-depth measure. If an attacker intercepts an authorization code and attempts to use it after the legitimate client has
already exchanged it, the server should revoke the tokens issued to the legitimate client. This alerts the system to a potential breach
and limits the damage from a compromised code.

Current Behavior

When a used authorization code is presented at the token endpoint:

1. GetCodeByCodeHash(..., codeHash, false) returns nil (filters for used = false)
2. Token endpoint returns invalid_grant error
3. Previously issued tokens remain valid

Proposed Behavior

When a used authorization code is presented:

1. Detect the replay attempt (query for the code without the used filter)
2. Find all refresh tokens associated with that code_id
3. Revoke them by setting revoked = true
4. Log an audit event (e.g., AuditAuthCodeReplayDetected)
5. Return invalid_grant error (same as current)

Implementation Notes

• Add a new query or modify GetCodeByCodeHash to optionally return used codes for replay detection
• Query refresh_tokens table by code_id to find tokens to revoke
• Consider rate limiting or additional logging for forensic purposes
• Access tokens are JWTs and cannot be revoked directly, but revoking refresh tokens prevents further token renewal

References

• RFC 6749 Section 10.5: https://datatracker.ietf.org/doc/html/rfc6749#section-10.5
• Current code validation: src/core/validators/token_validator.go:125-131
• Token revocation logic: src/authserver/internal/handlers/handler_token.go:110