Subject: [OAUTH-WG] PKCE and refresh tokens

From: Albin Nilsson <[email-masked]>
Date: Fri, 28 Feb 2020 16:46:46 +0100

Hello,

I'm having some trouble with oauth and the Authorization Code flow and
PKCE. How can I get a refresh token? The refresh token flow requires a
client_secret, but PKCE prohibits client_secret. Is refresh token a no go?

Kind regards,
Albin

---

From: Ron Alleva <[email-masked]>
Date: Fri, 28 Feb 2020 08:08:21 -0800

Hi Albin,

It’s important to note that PKCE does explicitly prohibit
client_secret, just offers a secure way of obtaining an access token
when it’s impossible for a client_secret to be kept secret, as would
be the case with a mobile application. The type of attack it prevents
against is during the authorization_code flow, where a malicious app
on the device could intercept the browser redirect happening, and
getting the authorization_code.

Since using a refresh token to get a new access token does not use the
browser redirect flow, it’s not subject to that type of attack, so
PKCE is not necessary.

I’d imagine which ever Authorization Server you are using would allow
you to get refresh tokens, and use them with or without client
authentication (see section 2.3 of the OAuth spec). It may or may not
require a client secret (even though said client secret is not
guaranteed to be secret).

Hope this helps (and I didn’t mess up any details :D),

Ron

On February 28, 2020 at 10:48:53 AM, Albin Nilsson ([email-masked]) wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: David Waite <[email-masked]>
Date: Fri, 28 Feb 2020 12:07:03 -0700

> On Feb 28, 2020, at 8:46 AM, Albin Nilsson <[email-masked]> wrote:
> 
> Hello,
> 
> I'm having some trouble with oauth and the Authorization Code flow and PKCE. How can I get a refresh token? The refresh token flow requires a client_secret, but PKCE prohibits client_secret. Is refresh token a no go?

PKCE provides XSRF protection and proof that the two parts of the code flow are from the same client. It does not forbid using client secrets, and is recommended by the security BCP for both public and confidential clients due to its XSRF protection.

Refresh token grant requests only require authentication (such as with a client secret) for confidential clients. Public clients are permitted to refresh without providing a secret or other credentials.

The lack of allowances for public clients by some implementations initially is why the AppAuth BCP and browser-based apps draft allows for the use of a secret in both the code request and refresh request - with the understanding by the AS that policy-wise this must be treated as a public client.

-DW

---

From: Naveen Agarwal <[email-masked]>
Date: Fri, 28 Feb 2020 12:13:33 -0800

Hi Albin,

Are you writing both the client and the server or writing client code to
auth against a standard server? Unless you are writing the auth server
code, using a library would be the best way to simplify.

Thanks

Naveen