<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 14/10/15 20:24, Stian Thorgersen
wrote:<br>
</div>
<blockquote
cite="mid:CAJgngAdobg-+SpNA3FPBX9jn2q+DzVBg8NV6XFX5RBfAQnHfuw@mail.gmail.com"
type="cite">
<div dir="ltr">Refresh tokens are no longer reusable. This is done
by setting the client sessions timestamp when a new refresh
token is issued. If the refresh tokens iat value is less than
the client sessions timestamp it's not permitted.
<div><br>
</div>
<div>If anyone has time I'd appreciate a review of the changes: <a
moz-do-not-send="true"
href="https://github.com/keycloak/keycloak/pull/1732"><a class="moz-txt-link-freetext" href="https://github.com/keycloak/keycloak/pull/1732">https://github.com/keycloak/keycloak/pull/1732</a></a><br>
<div><br>
</div>
<div>For anyone that runs into issues with this policy there's
an option to disable it in the admin console in the realms
token settings.</div>
<div><br>
</div>
<div>This does not apply to offline tokens (at least yet). We
need to add it to offline tokens as well though as it's even
more important for those. There's two problems with offline
tokens though, firstly the setTimestamp is not permitted on
offline client sessions. Secondly if we allow setting it we
would have to persist it, unless someone can come up with
something clever.</div>
</div>
</div>
</blockquote>
I think we don't need to persist, but just save clientSession with
updated timestamp into infinispan/memory. Then during startup, the
timestamp of clientSessions will be updated to startup time
similarly like we have for lastSessionRefresh of user sessions. The
refresh will be allowed if (iat == clientSession.timestamp OR
startupTime == clientSession.timestamp) . In other words, first
refresh after server restart will be always allowed. <br>
<br>
There is some chance that there can be same refresh token used two
times (if attacker will do second refresh after server restart). But
then clientSession timestamp will be updated and regular user won't
be allowed to refresh his token and will recognize error.<br>
<br>
<br>
But question is, do we really want refreshTokenReusable to be
disabled by default? For offline tokens, people will often need to
save the offline token into their database on application side. With
refreshTokenReusable disabled, they will need to always write into
their DB and save new offline token after each refresh.<br>
<br>
Marek<br>
<br>
<blockquote
cite="mid:CAJgngAdobg-+SpNA3FPBX9jn2q+DzVBg8NV6XFX5RBfAQnHfuw@mail.gmail.com"
type="cite">
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>