Roll the refresh_token

[Timshel]

Hey,

We recently discussed the refresh_token in the SSO PR and during this discussion it occurred to me that the long lived refresh_token could be rolled as is done by some SSO client.

This is handled / expected by the Bitwarden clients since the response _refresh_login contain the potentially updated refresh_token.

[BlackDex]

@Timshel, regarding the Rolling you just pushed.
Have you tried it in the web-vault?

You probably need to set the token/refresh validity lower, else you have to wait a long time hehe.

But i think it will break. It would be great of ot will not, but i have my doubts.

[Timshel]

Yep, trick I found to trigger the refresh token without waiting are :

• In web create a collection, it will trigger multiple refresh_token
• In mobile it's more complicated, need to lower the access_token validity (like 6min) then a Synchronisation will trigger a refresh if the access_token is close to expiration (5min, so you just need to wait one minute).

[Timshel]

Any feedback ?

[BlackDex]

I have not had any time yet to take a good look at it.

[Timshel]

Had issues with this, too many cases where the client call the refresh token endpoint in parallel.
So rolled it back out for now.