chadtmiller.com/pds.js
An atproto PDS in JavaScript, for Cloudflare Workers and Node
0
0
'@pdsjs/core': patch
A refresh token just rotated answers a replay with its replacement until that replacement is used, instead of refusing it. Browser apps lose the reply to a refresh whenever a page reloads, a link is followed or a laptop sleeps with the refresh in flight, then come back with the old token and were signed out. The tokens are DPoP-bound, so answering costs nothing without the session's key; a session revoked meanwhile stays revoked, and a spent token isn't listed as a session of its own.