Does it make send to allow a web client app (JavaScript) to refresh Access Toke using Access Token (not Refresh Token) that is about to expire? What are the drawbacks of using this process?

  • it makes total sense. what the alt? typing in a pw every hour? – dandavis Sep 9 '16 at 20:56
  • well, there is a refresh token that can be used to get another access token. – Maksim Sep 10 '16 at 19:55

In fact, you surely must do this in all normal processes. Otherwise, you are forcing your users to go through a full login again.

Given the weaknesses of web tokens like JWT (e.g prone to main-in-the-middle capture and replay attacks), keeping token expiries short is a must. This reduces at least, the opportunities for an attacker to obtain a valid token (via a MiTM attack), and then using it in a replay attack.

If you want to increase token expiry times, you need to add further protections to the communications process such as passing encrypted signature type data such as IP addresses to reduce the risk of a replay attack.

| improve this answer | |
  • But I thought if you are using password grant then to renew access token one must use refresh token instead. – Maksim Sep 12 '16 at 14:24
  • Isn't that implied in your Q? I am agreeing. Maybe I wasn't clear on the disadvantages because I went off at a tangent on the failings of token approaches overall! That's because I believe those issues are far bigger than any weaknesses in the token refresh process. – Julian Knight Sep 12 '16 at 14:31
  • just clarified my question. And I also noticed that one word was placed in the wrong location which made my question confusing. – Maksim Sep 12 '16 at 17:26

With the rationale below I would advise against it.

I have just asked a similar question:

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

We chose to do it in a different way, simple due to the following problem: The storage of the access token in the implicit flow might be subject to compromittation, and as such should never be valid for more than its actual lifetime.

Otherwise you could take out the access token from the SPA (Javascript Web App, Single Page Application) and use it for other things, being able to always refresh the token using the access token itself. This is usually not what you would want to happen. You want something additional to prove that the caller is really the one the token claims he is, e.g. an IdP session.

Usually, an access token is usable not only from within a browser for doing CORS calls, it can be used with any http client mocking the behavior of the browser, i.e. also in scripting. And opening such an endpoint gives you a fully script-usable API with an infinitely valid access token (or: infinitely renewable access token). Depending on your use case, this may be an issue.

| improve this answer | |

If you have a valid access token you have access to do anything your normally would be able to do with this given access token. So if you trust how they got this token, you can trust them when they want another.

The only downside would be if you're using this to enforce logout after a certain amount of time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.