Re: [OAUTH-WG] PKCE and refresh tokens

Hi Albin,

It’s important to note that PKCE does explicitly prohibit
client_secret, just offers a secure way of obtaining an access token
when it’s impossible for a client_secret to be kept secret, as would
be the case with a mobile application. The type of attack it prevents
against is during the authorization_code flow, where a malicious app
on the device could intercept the browser redirect happening, and
getting the authorization_code.

Since using a refresh token to get a new access token does not use the
browser redirect flow, it’s not subject to that type of attack, so
PKCE is not necessary.

I’d imagine which ever Authorization Server you are using would allow
you to get refresh tokens, and use them with or without client
authentication (see section 2.3 of the OAuth spec). It may or may not
require a client secret (even though said client secret is not
guaranteed to be secret).

Hope this helps (and I didn’t mess up any details :D),

Ron

On February 28, 2020 at 10:48:53 AM, Albin Nilsson (albin@bergson.nu) wrote:
> Hello,
>
> I'm having some trouble with oauth and the Authorization Code flow and
> PKCE. How can I get a refresh token? The refresh token flow requires a
> client_secret, but PKCE prohibits client_secret. Is refresh token a no go?
>
> Kind regards,
> Albin
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>