Subject: [OAUTH-WG] Refresh token security considerations

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 8 Jul 2011 11:08:16 -0700

"the authorization server SHOULD deploy other means to detect refresh token abuse"

This requires an example.

EHL

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 10 Jul 2011 11:21:12 +0300

replacement of the refresh token with every access token refresh is an example. The authz server creates and returns a new refresh token value with every access token refreshment. The old value is invalidated and must not be used any further. Note: The authz server keeps track of all old (invalidated) refresh tokens.

If a client presents one of those old refresh tokens, the legitimate client has been compromised most likely. The authz then revokes the refresh token and the associated access authorization.

regards,
Torsten.

Eran Hammer-Lahav <[email-masked]> schrieb:

“the authorization server SHOULD deploy other means to detect refresh token abuse”

 

EHL

---

From: "William J. Mills" <[email-masked]>
Date: Sun, 10 Jul 2011 09:38:18 -0700 (PDT)

I agree that this is something you could do, but it doesn't seem like a good design pattern.

________________________________
From: Torsten Lodderstedt <[email-masked]>
To: Eran Hammer-Lahav <[email-masked]>; OAuth WG <[email-masked]>
Sent: Sunday, July 10, 2011 1:21 AM
Subject: Re: [OAUTH-WG] Refresh token security considerations

regards,
Torsten.

>This requires an example. 
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Torsten Lodderstedt <[email-masked]>
Date: Tue, 12 Jul 2011 10:53:21 +0300

Why?

"William J. Mills" <[email-masked]> schrieb:

_____________________________________________

regards,
Torsten.

 

EHL

---

From: "William J. Mills" <[email-masked]>
Date: Tue, 12 Jul 2011 08:29:28 -0700 (PDT)

Why would you re-issue a refresh token every usage?  What's the use case where this makes sense?

The way I always think about the design is that refresh tokens are indended to be multi-use.  

________________________________
From: Torsten Lodderstedt <[email-masked]>
To: William J. Mills <[email-masked]>; Eran Hammer-Lahav <[email-masked]>; OAuth WG <[email-masked]>
Sent: Tuesday, July 12, 2011 12:53 AM
Subject: Re: [OAUTH-WG] Refresh token security considerations

Why?

---

From: Brian Eaton <[email-masked]>
Date: Tue, 12 Jul 2011 09:32:40 -0700

> Why would you re-issue a refresh token every usage?  What's the use case

It's key rotation built into the protocol.  Even if a refresh token is
stolen, it's going to become useless to the attacker very quickly.

My main concern with rotating refresh tokens with every use is that it
can cause problems with distributed client apps; they have to keep the
refresh token in sync, and it adds complexity.  But for desktop and
mobile apps it's quite a good idea.

(You can see a similar design in how Active Directory manages kerberos
machine keys.  They took a slightly different approach, in that the
client machines phone home to change their keys, but it provides
similar benefits.)

---

From: Phil Hunt <[email-masked]>
Date: Tue, 12 Jul 2011 10:27:30 -0700

+1

Maybe either way at the issuers discretion (optional) until we have a strong feeling why one technique is particularly problematic. i.e. if the server chooses to provide a new refresh token the old token is expired.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: "William J. Mills" <[email-masked]>
Date: Wed, 20 Jul 2011 21:22:08 -0700 (PDT)

Key rotation I understand.  Forcing expiry on every reissue seems extreme though.

________________________________
From: Brian Eaton <[email-masked]>
To: William J. Mills <[email-masked]>
Cc: Torsten Lodderstedt <[email-masked]>; Eran Hammer-Lahav <[email-masked]>; OAuth WG <[email-masked]>
Sent: Tuesday, July 12, 2011 9:32 AM
Subject: Re: [OAUTH-WG] Refresh token security considerations