2

I am considering moving my SPA from Implicit flow to Authorization Code + PKCE extension.

This new flow will provide the SPA with a Refresh Token that doesn't expire.

Let's say a malicious user on the computer/browser manages to get hold of the Refresh Token from the browser.

What are the remediations I need to set-up on the IdP and other systems to impersonate my SPA and indefinitely exchange the Refresh token for a new pair of Access Token and Refresh Token?

I've looked around and have found no clear explanation on this matter.

Thanks!

Improve this question

1 Answer 1

Reset to default
3

Spec-compliant authorization code grant does not issue refresh tokens, that's one of many reasons why it's recommended. (Implicit grant also does not issue refresh tokens). With authorization code grant you're supposed to obtain a new access token without a refresh token by either relying on the existing authorization server session and performing the authorization code grant redirect again or via an iframe a la OpenID Connect.

The overall topic of protecting a refresh token is well documented in oAuth 2.0 Security Best Current Practices (BCP).

Improve this answer
1
  • That's entirely correct spec-compliant Authorization code grant does not issue refresh tokens. From my understanding reading the OAuth 2.0 spec refresh token is optional and at our discretion - not tied on a given grant type. The existing authorization server session or iframe is one way of extending the session without the refresh token, I will delve into these options a bit more and revert back here, thanks!
    – Ali
    Commented Aug 5, 2019 at 9:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .