0

I don't really understand at all the protection scenario when a refresh token is stolen. Please explain.

Let's say there is this situation: the user is authorized in a mobile app and this app contains two tokens - a short-living access token and a long-living refresh token. Now, the attacker somehow steals both tokens from the user's device and immediately uses the refresh token to get a new pair of tokens, making the old tokens invalid. After that, when the user tries to use his old refresh token it will be invalid, and he will have to login again using his password.

At this point, the server should invalidate all other refresh tokens to prevent further usage by an attacker. But how then to implement multiple device authorization for one user, if there is only one refresh token available at a single time?

Improve this question
3
  • 1
    "But how then implement multiple device authorization for one user if there is only available one refresh token at time?" - it is only your assumption that there is only one refresh token per user but it is not a requirement. That the token should be bound to the user does not mean that it should be only bound to this user. In case you need parallel multi-device access for the same user you can bind the token additionally to something else, like for example the device IP address or some device specific token.
    – Steffen Ullrich
    Jul 21, 2018 at 13:48
  • @SteffenUllrich thanks, I see now... So I can use some composite data (for example used_id+device_id) as an identifier for refresh token.
    – Alek Depler
    Jul 21, 2018 at 17:21
  • 1
    Exactly, bind the refresh token to something specific to both device and user.
    – Steffen Ullrich
    Jul 21, 2018 at 18:24

1 Answer 1

Reset to default
1

In the scenario presented, you can grant the user distinct tokens for each authenticated device, and each such device would have its own unique identity. In this way, you would be applying that "one-per" limit to users and devices rather than to users alone so they can authorize multiple devices.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .