title: Web API authentication - returning the same OAUTH refresh token
body: <p>I am pretty new to this.. so any help would be greatly appreciated. 
  I have a WebApi service that uses OAUTH token and refresh token authentication. 
  All works well at the moment: </p>
  
  <p>step1: I send in the user and password and it generates an authentication token and a refresh token. The refresh token is saved in the DB.</p>
  
  <p>step2. I can now use the refresh token and i receive the authentication token and a new refresh token. I want a way to use the same refresh token i sent and not reuse a new one. </p>
  
  <p>This is my code for the refresh token: </p>
  
  <pre><code>public class SimpleRefreshTokenProvider : IAuthenticationTokenProvider
  {
      public async Task CreateAsync(AuthenticationTokenCreateContext context)
      {
          RefreshTokensRepository _repo = new RefreshTokensRepository();
  
          var clientid = context.Ticket.Properties.Dictionary["as:client_id"];
  
          //HERE I regenerate the token, but I have no idea how to retrieve the already sent one.
          var refreshTokenId = Guid.NewGuid().ToString("n");
  
          //saving in BD:
          var refreshTokenLifeTime = context.OwinContext.Get&lt;string&gt;("as:clientRefreshTokenLifeTime"); 
  
          var token = new RefreshTokens()
          {
              Id = Helper.GetHash(refreshTokenId),
              ClientId = clientid,
              Subject = context.Ticket.Identity.Name,
              IssuedUtc = DateTime.UtcNow,
              ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(refreshTokenLifeTime))
          };
  
          context.Ticket.Properties.IssuedUtc = DateTime.UtcNow;
          context.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(refreshTokenLifeTime));
  
          token.ProtectedTicket = context.SerializeTicket();
          var result = _repo.Add(token);
          if(!string.IsNullOrEmpty(result))
              context.SetToken(refreshTokenId);
      }
  
      public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
      {
          var allowedOrigin = context.OwinContext.Get&lt;string&gt;("as:clientAllowedOrigin");
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
  
          string hashedTokenId = Helper.GetHash(context.Token);
  
          RefreshTokensRepository _repo = new RefreshTokensRepository();
          var refreshToken = _repo.FindById(hashedTokenId);
          if (refreshToken != null)
          {
              //Get protectedTicket from refreshToken class
              context.DeserializeTicket(refreshToken.ProtectedTicket);
              _repo.Remove(hashedTokenId);
          }
      }
  
      void IAuthenticationTokenProvider.Create(AuthenticationTokenCreateContext context)
      {
          throw new NotImplementedException();
      }
  
      void IAuthenticationTokenProvider.Receive(AuthenticationTokenReceiveContext context)
      {
          throw new NotImplementedException();
      }
  }   
  </code></pre>
  
  <p>My code is based on this samples: 
  <a href="http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/" rel="nofollow noreferrer">http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/</a></p>
  
  <p>I would like to use the same sent refresh token, but I have no idea how to use the already sent one in this context. 
  Any ideas? </p>