Hacker News Reader

I did not get the impression that there is an attempt to reuse the authorization code, but rather that a completely new flow was initiated.

Reusing the same authorization code should of course be considered suspicious.

View on HN

Ah, yes, that's correct. I guess I was assuming that once you issue a new authorization code, the authorization server should invalidate any previously issued access_tokens/refresh_tokens because the new authorization code represents a new grant. Or are you supposed to wait until the code is sent to the token endpoint (to get the access_token/refresh_token) before invalidating old access_tokens?

For web app clients, you definitely don't want to invalidate other access tokens in case the user has other sessions open. For native clients, the calculus might be different.

Reply on news.ycombinator.com