Auth0 Refresh Token Rotation Automatic Reuse Detection Issue in iOS App

An issue occurs with automatic reuse detection when enabling refresh token rotation for an iOS application, resulting in Failed Exchange of Rotating Refresh Token (ferrt) error logs. Application code bugs, such as calling the store method manually or creating multiple versions of the Credentials Manager, cause this issue. Resolve this by verifying the SDK version and ensuring the application code does not trigger breach detection. The tenant logs display ferrt events, even with a high leeway time.

• Auth0
• Refresh Token Rotation
• Automatic Reuse Detection
• iOS Application

One of the following application code configurations causes the issue:

• Calling the store method manually.
• Creating multiple versions of the CredentialsManager, such as from a computed property.
• Calling the renew method from the Auth API client separately from the Credentials Manager.
• Exchanging a token older than the previous token. Only the previous token can be reused. If the application exchanges the second-to-last token, Auth0 triggers breach detection regardless of the leeway time. The tenant logs indicate this when the tokenCounter is not exactly one less than the latestCounter. An example of this log detail is as follows:

"details": {
    "familyId": "<REDACTED>",
    "tokenCounter": 4,
    "latestCounter": 6
}

How is the automatic reuse detection issue resolved?

Verify the application code, check the Swift SDK version, and review the tenant logs to ensure the token exchange process functions correctly.

1. Verify the Swift SDK version used for the iOS application. Auth0.Swift versions starting from v2.0.0 include a thread-safe Credentials Manager.
2. Review the application code to ensure the store method is not called manually. Review the Auth0.swift Pull Request 693 for more details.
3. Ensure the application code does not create multiple versions of the CredentialsManager.
4. Verify the renew method from the Auth API client is not called separately from the Credentials Manager.
5. Review the tenant logs to confirm the tokenCounter is exactly one less than the latestCounter.
6. If the issue persists and testing proves it is an SDK bug rather than an application code bug, create a reproducible example using the Quickstart sample application and submit a GitHub issue in the SDK repository.