Merge pull request #4951 from IdentityServer/dom/fix-consumed-time

Add null check before setting consumedTime
IdentityServer · Oct 7, 2020 · 60f406e · 60f406e
2 parents 2ba07d3 + b4c3b3c
commit 60f406e
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/IdentityServer4/src/Services/Default/DefaultRefreshTokenService.cs b/src/IdentityServer4/src/Services/Default/DefaultRefreshTokenService.cs
@@ -227,8 +227,11 @@ public virtual async Task<string> UpdateRefreshTokenAsync(string handle, Refresh
                 Logger.LogDebug("Token usage is one-time only. Setting current handle as consumed, and generating new handle");
 
                 // flag as consumed
-                refreshToken.ConsumedTime = Clock.UtcNow.UtcDateTime;
-                await RefreshTokenStore.UpdateRefreshTokenAsync(handle, refreshToken);
+                if (refreshToken.ConsumedTime == null)
+                {
+                    refreshToken.ConsumedTime = Clock.UtcNow.UtcDateTime;
+                    await RefreshTokenStore.UpdateRefreshTokenAsync(handle, refreshToken);
+                }
 
                 // create new one
                 needsCreate = true;