← All practicals

Trip a detector, raise an alert

Reuse a rotated refresh token and watch ITDR fire a real security alert (token theft).

1. 1

   Register your own app (P7 — needs an invite) and finish an offline_access grant, then rotate the refresh token once.

   Rotation consumes the old refresh token and mints a new one in the same family — the old token is now single-use spent. The seeded Demo RP cannot stand in here: it is authorization-code-only and holds no refresh grant.

2. 2

   Present the OLD (already-rotated) refresh token a second time.

   Reuse of a consumed token is the classic stolen-token signal: the Lab revokes the whole family AND emits oidc.refresh_reuse_detected.

3. 3

   That reuse trips the token_theft detector — a critical security alert is raised.

   ITDR turns that audit signal into a durable, acknowledgeable alert (itdr.alert_raised) an instructor can triage on the SOC dashboard — deterministic detection, no ML, no guesswork.