# OAuth2 Rotating Refresh Token Detector
# Captures NEW refresh tokens returned during token refresh
# 
# Modern OAuth2 security best practice: refresh tokens rotate
# Each refresh returns both new access AND refresh tokens
#
# Example refresh response:
# {
#   "access_token": "new-access-token-xxx",
#   "refresh_token": "new-refresh-token-yyy",  // <-- This is NEW!
#   "expires_in": 3600
# }
#
# Created: December 2024
# Author: Web Performance Inc

detector.name=OAuth2 Rotating Refresh Token

# Same pattern as original refresh token detector
# But this one specifically looks in refresh responses
search.pattern="refresh_token"\\s*:\\s*"([^"]+)"

# Only in refresh token responses (JSON)
content_type.pattern=(?i).*json.*|.*javascript.*|.*html.*

groups.count=1

# CRITICAL: Must be sticky to replace old refresh token
group1.sticky=true

# Same family as original refresh tokens
# This ensures the new token replaces the old one
equivalency.name.family=OAuth2-Refresh

unescape.source=Only Javascript

# Enable to support rotating refresh tokens
detector=sread

# Platform detection metadata
platform=oauth2
detection.hint=JSON with "access_token", "refresh_token", "token_type", or "Bearer" authorization
