feat: Redis-backed refresh tokens, JTI blacklist, and httpOnly cookies#149

Open

GitAddRemote wants to merge 9 commits intomainfrom

feature/ISSUE-109

Commits on Apr 28, 2026

feat: Redis-backed refresh tokens, JTI blacklist, httpOnly cookies
GitAddRemote
committed
fix: address code review findings on JTI auth implementation
GitAddRemote
committed
fix: atomic refresh token rotation and TTL preservation
GitAddRemote
committed
fix: fail closed on Redis unavailability and prevent immortal refresh tokens
GitAddRemote
committed
fix: session-family logout invalidation and explicit Redis fail-closed behavior
GitAddRemote
committed
fix: close logout race and prevent session expiry before refresh token
GitAddRemote
committed
fix: tie access token validation to session family liveness
GitAddRemote
committed

Commits on Apr 29, 2026