I'm working to implement a OAuth 2.0 server, and while reading the RFC6749 specification I realized that section 6 on Page 47 regarding "Refreshing an Access Token". Explains that we need to just use the Refresh Token that we have to get a new Token.
But for example, in addition to the Refresh Token, Google require the User ID and the Secret to do so.
This confuses me, because on one hand we have Google that is processing high volume of requests every day, and we have a specification written probably with a smaller scope in mind.
Is it good to send the Secret every hour with the Refresh Token?
Personally I believe no: because the User ID and Secret should be used only to go over the whole OAuth 2.0 process.
- You use the token on each request to prove that you are who you are.
- Refresh Token get used only once an hour (and potentially changed at each refresh)
- Secret and User ID go to the internet as rarely as possible. Only when option 1 and 2 get compromised.
I personally believe that sending the Secret with the Refresh token is less secure. But maybe I'm missing something.
If you have another point of view, please share it :)