0

I don't really understand at all the protection scenario when a refresh token is stolen. Please explain.

Let's say there is this situation: the user is authorized in a mobile app and this app contains two tokens - a short-living access token and a long-living refresh token. Now, the attacker somehow steals both tokens from the user's device and immediately uses the refresh token to get a new pair of tokens, making the old tokens invalid. After that, when the user tries to use his old refresh token it will be invalid, and he will have to login again using his password.

At this point, the server should invalidate all other refresh tokens to prevent further usage by an attacker. But how then to implement multiple device authorization for one user, if there is only one refresh token available at a single time?

  • 1
    "But how then implement multiple device authorization for one user if there is only available one refresh token at time?" - it is only your assumption that there is only one refresh token per user but it is not a requirement. That the token should be bound to the user does not mean that it should be only bound to this user. In case you need parallel multi-device access for the same user you can bind the token additionally to something else, like for example the device IP address or some device specific token. – Steffen Ullrich Jul 21 '18 at 13:48
  • @SteffenUllrich thanks, I see now... So I can use some composite data (for example used_id+device_id) as an identifier for refresh token. – Alek Depler Jul 21 '18 at 17:21
  • 1
    Exactly, bind the refresh token to something specific to both device and user. – Steffen Ullrich Jul 21 '18 at 18:24
1

In the scenario presented, you can grant the user distinct tokens for each authenticated device, and each such device would have its own unique identity. In this way, you would be applying that "one-per" limit to users and devices rather than to users alone so they can authorize multiple devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.