fix: rename nonRotating to preserveRefreshToken and fix revokeRefreshToken in online mode

Renamed the internal worker message field `nonRotating` to `preserveRefreshToken` across
worker.types.ts, token.worker.ts, http.ts, and api.ts to eliminate the confusing double-
negative at the use site (!nonRotating) in security-critical code.

Fixed revokeRefreshToken() in online mode: removed the incorrect no-op guard — the /oauth/revoke
endpoint accepts Online Refresh Tokens and, because ORTs are session-bound, revocation also
terminates the Auth0 session server-side. Updated JSDoc and the sample page to reflect this
behaviour accurately.

Author: NandanPrabhu

src/Auth0Client.ts

@@ -1222,16 +1222,18 @@ export class Auth0Client {
    *
    * If `useRefreshTokens` is disabled, this method does nothing.
    *
-   * **Online mode:** when `refreshTokenMode` is `'online'` this method only clears the
-   * cached refresh token locally — it does **not** revoke the Online Refresh Token at the
-   * authorization server. Online Refresh Tokens are non-rotating and session-bound, and the
-   * server does not support token-only revocation for them. To end an online session, use
-   * `logout()` instead, which terminates the session and thereby invalidates the ORT.
+   * **Online mode:** when `refreshTokenMode` is `'online'`, revoking the ORT via
+   * `/oauth/revoke` **also terminates the Auth0 session**. Because Online Refresh Tokens
+   * are session-bound, the authorization server ties the token directly to the session —
+   * revoking the ORT invalidates the session server-side. This means the user will be
+   * required to log in again even if their session cookie has not yet expired.
+   * Use this when you need to force a sign-out without a redirect (e.g. background
+   * revocation). For a redirect-based sign-out, prefer `logout()`.
    *
    * **Important:** This method revokes the refresh token for a single audience. If your
    * application requests tokens for multiple audiences, each audience may have its own
    * refresh token. To fully revoke all refresh tokens, call this method once per audience.
-   * If you want to terminate the user's session entirely, use `logout()` instead.
+   * If you want to terminate the user's session with a redirect, use `logout()` instead.
    *
    * When using Multi-Resource Refresh Tokens (MRRT), a single refresh token may cover
    * multiple audiences. In that case, revoking it will affect all cache entries that
@@ -1758,7 +1760,7 @@ export class Auth0Client {
           timeout: this.httpTimeoutMs,
           useMrrt: this.options.useMrrt,
           dpop: this.dpop,
-          nonRotating: this.onlineAccess,
+          preserveRefreshToken: this.onlineAccess,
           ...options,
           scope: scopesToRequest || options.scope,
         },

src/api.ts

@@ -38,7 +38,7 @@ export async function oauthToken(
     useFormData,
     useMrrt,
     dpop,
-    nonRotating,
+    preserveRefreshToken,
     ...options
   }: TokenEndpointOptions,
   worker?: Worker,
@@ -92,7 +92,7 @@ export async function oauthToken(
     isDpopSupported ? dpop : undefined,
     undefined,
     skipTokenStorage,
-    nonRotating
+    preserveRefreshToken
   );
 }
 

src/http.ts

@@ -74,7 +74,7 @@ const fetchWithWorker = async (
   useFormData?: boolean,
   useMrrt?: boolean,
   skipTokenStorage?: boolean,
-  nonRotating?: boolean
+  preserveRefreshToken?: boolean
 ) => {
   return sendMessage(
     {
@@ -89,7 +89,7 @@ const fetchWithWorker = async (
       useFormData,
       useMrrt,
       skipTokenStorage,
-      nonRotating
+      preserveRefreshToken
     },
     worker
   );
@@ -105,7 +105,7 @@ export const switchFetch = async (
   timeout = DEFAULT_FETCH_TIMEOUT_MS,
   useMrrt?: boolean,
   skipTokenStorage?: boolean,
-  nonRotating?: boolean
+  preserveRefreshToken?: boolean
 ): Promise<any> => {
   if (worker) {
     return fetchWithWorker(
@@ -118,7 +118,7 @@ export const switchFetch = async (
       useFormData,
       useMrrt,
       skipTokenStorage,
-      nonRotating
+      preserveRefreshToken
     );
   } else {
     return fetchWithoutWorker(fetchUrl, fetchOptions, timeout);
@@ -137,7 +137,7 @@ export async function getJSON<T>(
   dpop?: Pick<Dpop, 'generateProof' | 'getNonce' | 'setNonce'>,
   isDpopRetry?: boolean,
   skipTokenStorage?: boolean,
-  nonRotating?: boolean
+  preserveRefreshToken?: boolean
 ): Promise<T> {
   if (dpop) {
     const dpopProof = await dpop.generateProof({
@@ -164,7 +164,7 @@ export async function getJSON<T>(
         timeout,
         useMrrt,
         skipTokenStorage,
-        nonRotating
+        preserveRefreshToken
       );
       fetchError = null;
       break;
@@ -239,7 +239,7 @@ export async function getJSON<T>(
         dpop,
         true, // !
         skipTokenStorage,
-        nonRotating
+        preserveRefreshToken
       );
     }
 

src/worker/token.worker.ts

@@ -82,7 +82,7 @@ const checkDownscoping = (scope: string, audience: string): boolean => {
 }
 
 const messageHandler = async ({
-  data: { timeout, auth, fetchUrl, fetchOptions, useFormData, useMrrt, skipTokenStorage, nonRotating },
+  data: { timeout, auth, fetchUrl, fetchOptions, useFormData, useMrrt, skipTokenStorage, preserveRefreshToken },
   ports: [port]
 }: MessageEvent<WorkerRefreshTokenMessage>) => {
   let headers: FetchResponse['headers'] = {};
@@ -188,9 +188,7 @@ const messageHandler = async ({
 
       setRefreshToken(json.refresh_token, audience, scope);
       delete json.refresh_token;
-    } else if (!nonRotating) {
-      // Non-rotating (online) refresh tokens come back without a replacement;
-      // keep the stored ORT instead of evicting it.
+    } else if (!preserveRefreshToken) {
       deleteRefreshToken(audience, scope);
     }
 

src/worker/worker.types.ts

@@ -21,10 +21,10 @@ export type WorkerRefreshTokenMessage = WorkerTokenMessage & {
   useMrrt?: boolean;
   skipTokenStorage?: boolean;
   /**
-   * Non-rotating refresh token (Online Refresh Token). When set, the worker keeps
-   * the stored token if the response carries no replacement, instead of deleting it.
+   * When true the worker keeps the stored token if the response carries no replacement
+   * (Online Refresh Tokens are non-rotating and never come back with a new token).
    */
-  nonRotating?: boolean;
+  preserveRefreshToken?: boolean;
 };
 
 export type WorkerRevokeTokenMessage = Omit<WorkerTokenMessage, 'auth'> & {

static/online-access.html

@@ -390,12 +390,16 @@ <h2>Access token (last exchange)</h2>
       await refreshDiagnostics(client);
     }
 
-    // Calls revokeRefreshToken and reports the raw outcome. Online: clears the local cache only,
-    // the ORT is NOT revoked server-side. Offline: revokes the rotating RT at the server.
+    // Calls revokeRefreshToken.
+    // Online (memory/worker mode): the ORT lives in the worker's in-memory store.
+    //   revokeToken sends a 'revoke' message to the worker → worker calls /oauth/revoke
+    //   with the ORT → deletes it from its store. Server-side revocation works.
+    // Offline: rotating RT read from ICache → revoked at server.
     async function revoke(client) {
       var before = readRefreshTokenFromCache();
       tokenOutEl.textContent = 'Revoking refresh token…';
 
+      var t0 = performance.now();
       var error;
       try {
         // The RT is cached under the login audience; pass it so the lookup finds the token.
@@ -404,6 +408,7 @@ <h2>Access token (last exchange)</h2>
       } catch (err) {
         error = err instanceof Error ? err.message : String(err);
       }
+      var ms = Math.round(performance.now() - t0);
 
       var after = readRefreshTokenFromCache();
 
@@ -412,13 +417,14 @@ <h2>Access token (last exchange)</h2>
           {
             mode: mode,
             note: mode === 'online'
-              ? 'Online: local cache cleared only; ORT NOT revoked server-side. Use logout() to end the session.'
+              ? 'Online (worker mode): ORT revoked at /oauth/revoke via worker. getTokenSilently should now fail.'
               : 'Offline: rotating refresh token revoked at the server.',
+            durationMs: ms,
             refreshTokenBefore: mask(before),
             refreshTokenAfter: mask(after),
-            changed: before !== after
+            cacheChanged: before !== after
           },
-          error ? { error: error } : null
+          error ? { error: error } : { success: true }
         ),
         null, 2
       );