Hello,
The reason I brought this up is that we are currently working on migrating out authentication from a commercially available product called Ping to Keycloak. We noticed that Ping invalidates the refresh token
after it is used once, while Keycloak does not.
I and my colleague, Kamal are concerned that by not invalidating the refresh token after first use, we may be opening a security hole. While SSL may protect the token in transit, we can see a scenario where
the refresh token would be compromised or stolen from the client itself. In this case, the stolen refresh token could be used to get new access tokens without the owner of the client machine knowing.
However, if the behavior was changed so that the refresh token could only be used once, then either:
1.
If the owner of the client machine would use the refresh token first, then the stolen refresh token could not be used
2.
If the stolen refresh token would be used first, then the client machine would not be able to use it and the user of that client machine could be alerted that something was wrong. This user could
then reset their password or invalidate all of their access and refresh tokens.
Furthermore, we are concerned about this same scenario, but with the offline token. My understanding is that the offline token does not expire and that it can’t be invalidated by logging out the user or changing
the user’s password. Have you thought about this scenario?
Thank You,
Mikhail Kuznetsov
Software Engineer
Hewlett Packard Enterprise
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Tuesday, October 06, 2015 1:16 PM
To: Raghu Prabhala
Cc: Kuznetsov, Mike; keycloak-dev@lists.jboss.org
Subject: Re: [keycloak-dev] Same Refresh token can be used multiple times to obtain access token
Hi Raghu,
From the specs, it looks to me that this is not anything mandatory. The paragraph is starting "For example". Feel free to create JIRA, but I personally can't promise anything regarding this...
Marek
On 06/10/15 17:37, Raghu Prabhala wrote: