Is it safe to refresh your access token using your access token (assuming of course it is still valid)?

And, if not, what makes a refresh token that much more special that it is safe to be used as a means of refreshing access tokens?

  • 1
    The advice I've seen is that when a refresh token gets a new access token is that you also issue a new refresh token. That is a refresh token can only be used once. See this recent presentation for details: pragmaticwebsecurity.com/talks/xssoauth.html – Swashbuckler Apr 13 at 1:40
  • I've watched that video, which gives mere advice. There's no hard yes/no on this question? The advice is quite logical if you think about it. A refresh token should be kept very private (RFC 6749 §10.4) and an access token can see multiple resource servers, meaning it's more likely to be compromised – Bram Apr 15 at 13:22

From my understanding, token is a stateless credential of access control, as such, tokens for accessing a particular service must have a reasonably limited lifetime.

Therefore, to gain such access, login and refresh tokens needs to be generated from a better-protected master key. This master key is typically the user credential (in the case of automated bots, application credential), and must be revocable should the service determine that it's being abused.

That's based on my experience of designing in-house applications, others may have better answers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.