OAuth2: Where should I store my refresh token in a stateless application?

Question

In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented.

I went to the hassle of implementing OpenID Connect (mainly thanks to authlib) to let the authenticated web applications being stateless. It also allows me to make requests between apps without reauthenticating users, by passing my JWT around. Thats very handy...

Now I am facing the following problem : If one of the said web application wanted to refresh their token instead of going through the whole code flow again, they would need to store a refresh token somewhere in the backend, where it is secured.

Sadly this would break the stateless authentication I was looking for, which forces me to mount some sort database on each one of my web applications that initially didn't need any.

Is there a way to refresh a JWT in a stateless way ? Or, to rephrase my question, where can I store my refresh token in a stateless application ?

Answer 1

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a little bit confusing on this point because it has been designed a long time ago, before SPA were dominant. The main issue is that, at first, you probably considered the api servers as the relying parties and the angular application as just "front". At least it was the problem that I had. And it's simply not the case.

The key point here are that:

• Your SPA is the relying party, not the flask APIs server.
• Your APIs only need to validate the JWT token, not to take part in the authentication flow or get access to refresh tokens etc.
• Your SPA doesn't need to obtain/use refresh token as those are mainly use by more "controlled" type of services. Instead openid connect includes an iframe logic in its specs, allowing the RP to get new access and id tokens when the current access token is close to the validation end date time.

The next question is which authorisation grant flow you should use ? The answer is PKCE. You don't want to use implicit because there are known security breaches. You can't use classical code flow because you'll need to put the client secret in the angular app. Luckily that's exactly why PKCE has been created: https://www.rfc-editor.org/rfc/rfc7636

And to implement that you'll need 2 things:

• Implement the PKCE logic in angular, but somebody already did most of the work: https://manfredsteyer.github.io/angular-oauth2-oidc/docs/additional-documentation/code-flow-+-pcke.html
• A python lib that simply check the received token to authenticate the user at the api level. I don't know flask very well but for Django I use a small lib: https://github.com/ByteInternet/drf-oidc-auth. That lib is basically one file. You want stateless so you want to use a JWT instead of a Bearer.

Once you're there, the system will probably suit your needs:

• Long run authentication is handled by the IP, and as long as the user is logged in at the ip level, the iframe will ensure that his access/id tokens are up-to-date.
• API servers are stateless and don't require a database.