Tencent/WeKnora · error

refresh token is revoked

Error message

refresh token is revoked

What it means

Raised in RefreshToken when the token row exists but IsRevoked is true (or the row lookup failed) — the presented refresh token was already revoked (logout, rotation, or admin revocation) and must not be honored. Reuse-detection guard against replayed tokens.

Source

Thrown at internal/application/service/user.go:1347

	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok {
		return "", "", errors.New("invalid token claims")
	}

	tokenType, ok := claims["type"].(string)
	if !ok || tokenType != "refresh" {
		return "", "", errors.New("not a refresh token")
	}

	userID, ok := claims["user_id"].(string)
	if !ok {
		return "", "", errors.New("invalid user ID in token")
	}

	// Check if token is revoked
	tokenRecord, err := s.tokenRepo.GetTokenByValue(ctx, refreshTokenString)
	if err != nil || tokenRecord == nil || tokenRecord.IsRevoked {
		return "", "", errors.New("refresh token is revoked")
	}
	if tokenRecord.TokenType != "refresh_token" {
		return "", "", errors.New("not a refresh token")
	}

	// Get user
	user, err := s.userRepo.GetUserByID(ctx, userID)
	if err != nil {
		return "", "", err
	}

	// Revoke old refresh token
	tokenRecord.IsRevoked = true
	_ = s.tokenRepo.UpdateToken(ctx, tokenRecord)

	// Generate new tokens
	return s.GenerateTokens(ctx, user)
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Reject with 401 and require re-authentication
2. If rotation is in use, treat repeated use of the revoked token as a possible replay and revoke the family

When it happens

Trigger: Thrown at internal/application/service/user.go:1347 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/4ff751002e8f3c03. Report an issue: GitHub.