Skip to main content
4 votes

Security doubts around the refresh token and how it works

You're mixing parts of the OAuth specification with implementation details and personal opinions from a user of a forum. This isn't very helpful when trying to understand the concepts of the OAuth ...
Ja1024's user avatar
  • 10.1k
3 votes

Why don't bank verification services use OAuth

Why aren't they doing this? There needs to be a standard API for this which third party services could use. While OAuth2 and OpenID Connect could provide such API in general it needs to be configured ...
Steffen Ullrich's user avatar
2 votes
Accepted

Should standard OAuth endpoints/configuration files be kept private?

They're placed at a standard location because they are required to be publicly accessible. It's not a security weakness; it's literally a requirement for the systems to work. They do not reveal any ...
vidarlo's user avatar
  • 16.6k
1 vote

Security implications of using the current session to mint new access tokens

Fundamentally, a refresh token generally is a session token[1] that can only access a single resource. There's lots of good reasons for this design - it means you can get the scalability benefits of ...
CBHacking's user avatar
  • 49.3k
1 vote

Bearer JWT client authentication and access token issued by authorization server

Both aud and iss identify participants in the authentication flow. iss identifies the participant issuing a token, in your scenario the access token aud identifies the participant(s) that may accept ...
Heiko Theißen's user avatar
1 vote

Do we really need refresh tokens?

There is a lot of literature both from identity vendors / platforms and from the folks behind OAuth and OpenID Connect as to why refresh tokens are necessary. Here are some of the benefits Make ...
David Brossard's user avatar
1 vote

why was implicit flow conceived?

In the Authorization Code Flow the authorization code is obtained directly by the client's user agent, but exchanging it for an access token can be done with a server-to-server request, with the ...
Heiko Theißen's user avatar
1 vote

Isn't there a critical built-in vulnerability in OAuth's Implicit flow?

First of all, the implicit flow is deprecated. it should not be used. (it has been replaced with the PKCE flow) The way the implicit flow works is by matching a known URI, source and client ...
LvB's user avatar
  • 8,963
1 vote

Should standard OAuth endpoints/configuration files be kept private?

If you looked up the documentation, you would find: Obtaining Authorization Server Metadata Authorization servers supporting metadata MUST make a JSON document containing metadata as specified in ...
schroeder's user avatar
  • 131k

Only top scored, non community-wiki answers of a minimum length are eligible