1

I have a system with an OAuth2 authorization server. It hands out JWT access tokens and refresh tokens (the latter only to the mobile app client).

We don't persist access tokens (as is normal with JWT) but we do persist the (hashed) refresh tokens together with some meta data to be able to revoke them so that users can log out other devices. We also only allow a single use for refresh tokens, the new request also gives back a new refresh token.

The OAuth2 login server itself uses regular basic auth with sessions. The user wants to be able to logout (single devices/clients) here. So of course I have to invalidate the session itself. But ideally I want to remove the refresh token that this client still has as well. The problem is that I don't know that refresh token. A particular user could in theory have request multiple of them with their code request. The refresh token is also not normally passed in requests (only the access token)

Should I ask the clients (which are currently all under our own development) to send along their unused refresh tokens? Even if they 'forget' their refresh tokens locally, it still seems better if I also delete them on the server so they don't linger around until their expiry time. Note I do know all the refresh tokens currently in use for a certain account but I don't want to just delete them all because that would mean all devices are logged out. We also save some user agent-like info with the refresh tokens so users can use that to manually logout other devices, but it seems like a bad idea to try to perform string matching on those to automate that process.

Improve this question

1 Answer 1

Reset to default
4

I would suggest alternative - that I encountered in one OAuth server implementation.

Instead of requiring clients to provide all refresh tokens for invalidation simply store logout record for some time.

The logout record would contain user identification, client identification and logout timestamp.

Your server do not need to know all invalid tokens, because it can assume that any presented token - that was issued before last logout - is invalid.

You need only one logout record for user-client pair - as later logout would also invalidate earlier tokens. You also need to store it no longer than the longest token time to live.

Improve this answer
3
  • That would only seem to work if users can only be logged in once on a single device right?
    – Sebastiaan van den Broek
    Oct 23, 2019 at 0:03
  • I do not think so - if devices are distinguishable you can have logout record with user-clinet-device-timestamp and log out all tokens issued to specific device. In addition you can have different forms of logout user---timestamp - log out from all clients and devices, user-client-*-timestamp - log out from specific client (application) on all devices, user-client-device-timestamp - log out specific client (application) on specific device.
    – AGrzes
    Oct 23, 2019 at 8:24
  • Not sure how I lost track of this question/answer but anyway I just accepted it. We still haven't gotten around to this story. It will need some rework but if storing enough client user agent data I think it can be done in this way.
    – Sebastiaan van den Broek
    Feb 16, 2022 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .