Is using refresh tokens a security hole?

earaujoassis / space

🚀 A user management microservice; OAuth 2 provider

MIT License

17 stars 6 forks source link

Is using refresh tokens a security hole? #76

Open earaujoassis opened 4 years ago

earaujoassis commented 4 years ago

Refresh tokens are defined with an eternalExpirationLength. Is that a security hole in the system? It must be investigated whether refresh tokens could be reused in an undefined period of time and what the RFC 6749 states about that.

earaujoassis commented 1 year ago

One solution:

create token hierarchy to organize tokens. If the parent token is invalidated, all heirs are also invalidated.