Is it safe to refresh your access token using your access token (assuming of course it is still valid)?
And, if not, what makes a refresh token that much more special that it is safe to be used as a means of refreshing access tokens?
-
2The advice I've seen is that when a refresh token gets a new access token is that you also issue a new refresh token. That is a refresh token can only be used once. See this recent presentation for details: pragmaticwebsecurity.com/talks/xssoauth.html– SwashbucklerCommented Apr 13, 2021 at 1:40
-
I've watched that video, which gives mere advice. There's no hard yes/no on this question? The advice is quite logical if you think about it. A refresh token should be kept very private (RFC 6749 §10.4) and an access token can see multiple resource servers, meaning it's more likely to be compromised– BramCommented Apr 15, 2021 at 13:22
Add a comment
|
3 Answers
No, it's not safe.
An attacker, who was able to steal one access token, can generate infinitely many access tokens from this one. That means that their access never expires and can't be blacklisted anymore.
From my understanding, token is a stateless credential of access control, as such, tokens for accessing a particular service must have a reasonably limited lifetime.
Therefore, to gain such access, login and refresh tokens needs to be generated from a better-protected master key. This master key is typically the user credential (in the case of automated bots, application credential), and must be revocable should the service determine that it's being abused.
That's based on my experience of designing in-house applications, others may have better answers.
An access token cannot be securely used to refresh an access token.
I will give you one example:
When a user is navigating on you website, he sends his requests with the access token. There are many ways in which an attacker can steal an access token, but to be simple, let's suppose that your website is using HTTP (not https), and that that there is a "Man in the middle (MITM)", so the MITM is able to view the token.
If he is able to steal that token and then uses that same token to refresh it, he will have infinite access to the stolen token.
The difference with the refresh token is that it is only sent when it is needed, so in the case of a MITM attack, the refresh token is not exposed to the attacker, so he can only steal the token that will expire but he will not be able to refresh it.
Depending on the information you are protecting you should implement other security measures.
For example, if you want to protect very important data, you may only allow one session per account that lasts 5 minutes (In fact you should not create access tokens that last too much time) and then has to be refreshed, but that depends on several factors.
