We are integrating with a vendor who have a unique (to us) OAuth 2.0 implementation: with every refresh request, they send us a new refresh token along with the access token.

They say that this was required as part of their work around getting SOC2, but I can't help but think that they misinterpreted something that their security consultants were recommending.

Any thoughts on what the reasoning may be on this?


The refresh token is not being expired at the same time as the access_token, it's being rotated upon usage.

From section of rfc6819:

Refresh token rotation is intended to automatically detect and prevent attempts to use the same refresh token in parallel from different apps/devices. This happens if a token gets stolen from the client and is subsequently used by both the attacker and the legitimate client. The basic idea is to change the refresh token value with every refresh request in order to detect attempts to obtain access tokens using old refresh tokens. Since the authorization server cannot determine whether the attacker or the legitimate client is trying to access, in case of such an access attempt the valid refresh token and the access authorization associated with it are both revoked.

(Bolds mine)

FWIW, every OAuth2 provider I used worked this way.


You would probably need to get the reasoning from them directly, but this design is compliant with the spec:

Issuing a refresh token is optional at the discretion of the
authorization server.  If the authorization server issues a
refresh token, it is included when issuing an access token

The most interesting property I can think that this provides is that if a client loses their refresh token and an attacker uses it to obtain a new refresh/access token pair, the legitimate client will fail to obtain a token the next time they refresh (unless the attacker can modify the state of the legitimate client). This could be used to do something like determine when all tokens issued to a particular client should be revoked (because it is assumed compromised).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.