search

IdentityModel / oidc-client-js

OpenID Connect (OIDC) and OAuth2 protocol support for browser-based JavaScript applications
Apache License 2.0
2.43k stars 840 forks source link

Support for Code Flow PKCE with Refresh tokens #1362

Open ghost opened 3 years ago

ghost commented 3 years ago

As far as I see, the oidc-client-js library supports only silent renewal with a silent renew callback URL. Is there a way to make it work with refresh token mechanism? If not, are there any plans to support it in the future?

brockallen commented 3 years ago

It supports refresh tokens and renewal already.

ghost commented 3 years ago

It supports refresh tokens and renewal already.

Cool, how can we configure to use refresh token? I don't see that in the documentation.

brockallen commented 3 years ago

Request offline_access as a scope, as per the spec. https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess

ghost commented 3 years ago

@brockallen Perfect, thanks a lot. It works when using offline_access scope. 🎉

Could you please mention it in the Wiki documentation? That would be helpful for other developers too.

brockallen commented 3 years ago

You know refresh tokens in the browser are not really recommended, though, right?

https://pragmaticwebsecurity.com/talks/xssoauth.html

ghost commented 3 years ago

That's what I thought at first. But recently, Auth0 recommends refresh token rotation as more secure than silent renewal with iframe.

See https://auth0.com/docs/tokens/refresh-tokens#for-single-page-apps image

brockallen commented 3 years ago

Did you watch the video above?

ghost commented 3 years ago

I just watched the video. Thanks for sharing. I understand the attacking vectors on refresh token rotation now.

Could you please explain how silent renewal with iFrame is still better than refresh token rotation? Is silent renewal with iFrame not vulnerable to XSS?

marwalsch commented 3 years ago

@keth-dev Were you able to get enlightened on that? I was wondering about the same. From what I understand from the video there is no way to avoid browser vulnerabilities aside from using BFF, which essentially means once someone busts your SPA with XSRF it doesn't really matter whether you use refresh token rotation or silent renewal.

brockallen commented 3 years ago

which essentially means once someone busts your SPA with XSRF it doesn't really matter whether you use refresh token rotation or silent renewal.

The difference is the amount of damage in what amount of time. A leaked refresh token will allow an attacker much longer and potentially infinite time if there's no absolute limit on the RT.

brockallen commented 3 years ago

which essentially means once someone busts your SPA with XSRF it doesn't really matter whether you use refresh token rotation or silent renewal.

The difference is the amount of damage in what amount of time. A leaked refresh token will allow an attacker much longer and potentially infinite time if there's no absolute limit on the RT.

The BFF approach we suggest (if you're using ASP.NET) is this one: https://blog.duendesoftware.com/posts/20210326_bff/

marwalsch commented 3 years ago

@brockallen I see, but once the length of sessions kept with the ID provider for silent renewal surpasses refresh token lifetime it should be virtually the same if I am not mistaken.