Re: [OAUTH-WG] allowing offline access for native app & its backend server

John Bradley <> Sat, 21 November 2015 14:00 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id AC0141A92B3 for <>; Sat, 21 Nov 2015 06:00:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id AsN43Gihbn7k for <>; Sat, 21 Nov 2015 06:00:42 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400d:c04::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DA0521A92AE for <>; Sat, 21 Nov 2015 06:00:41 -0800 (PST)
Received: by qgec40 with SMTP id c40so90258492qge.2 for <>; Sat, 21 Nov 2015 06:00:40 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=819BWgXlWvr8uYICSWZK6zf/C/nd+IU9qJCf152OeAA=; b=HZiy4ewh68nz+psxlC0/e6bvhlA9kE9e3r7vNn8fbiKnq4eDhHMn3UUjWJbrtQ+Q18 NiMcG2Svs9YqlCOZmwrDSCwMEMrBttP3hFFTJ1LeXxZJI9I/5uw5CtZYpXMRDQcZ/Db7 tzE8bVCa486b8j5Q8GOQUvz6ysve2RGR7kxsd1PGqHn3BgONj9U0iajWnVh2Zl3IrdIY 1kGzyh0YNxv568Y+VemVfkd8nP0Uf7Bh8gSdoFZiEBV/Ve5QVXsku0Tlyc5Iz8kpvgLf KxRSyGlXHVKhraaNGy8Gt7IuBDMusWkW/qAVIWuo7sB2z5CXd9zFd5tjc6zLigmbtzpi ZtVg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=819BWgXlWvr8uYICSWZK6zf/C/nd+IU9qJCf152OeAA=; b=iMzRtMWOP78c7pkRcrGX+vh54eCJwVsU2M0J/dMC792a5gH2IOcOHkN5fQcH2jNygM wIJN+TX78CMSesQqLersZsPjztu/PsQ2fDKXrmY7jdElUj+pB8bp/Fz7lpViQA9M0Vqk zESkMna7yFxDQ+qnKF+eTtEU2wD1xN8PFYqeXE0IHoV9rIr5QRNBoxxVS/MhQw2mNvpD e+hvci8nOvX6lQSWohBaodV7zcDNS+Dge7r99K28zguUhkvHXa2xYPP+tlg8cfH7Apty XS6k2e9Xt66T4cr58aL9U3BAHqBf60sV4/oRDCvWJnPXp66rxJDD4qCAw+2kSWebHIuo 7O+w==
X-Gm-Message-State: ALoCoQnFs8+fGOTXcsXhvUV4Zlj9vBRV6J1VvCzolEehwXDWsKFgAR5bHHzJmu/QimaknvxZzOne
X-Received: by with SMTP id l68mr18211646qgd.21.1448114440628; Sat, 21 Nov 2015 06:00:40 -0800 (PST)
Received: from [] ([]) by with ESMTPSA id x82sm714936qhx.40.2015. (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 21 Nov 2015 06:00:39 -0800 (PST)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\))
From: John Bradley <>
In-Reply-To: <>
Date: Sat, 21 Nov 2015 11:00:33 -0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <>
To: nov matake <>
X-Mailer: Apple Mail (2.2104)
Archived-At: <>
Subject: Re: [OAUTH-WG] allowing offline access for native app & its backend server
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 21 Nov 2015 14:00:43 -0000

There is a missing step in this flow that also needs to be considered, and that is how the app authenticates to the backend server.

In the Google case they are providing a JWT/id_token to the client from the token endpoint for the client to use for it’s authentication to it’s backend.

It would not be a huge step to have the backend then use token exchange along with it’s credentials to exchange that for a refresh token.

I can see giving out two codes and we have discussed that in the past.  

This topic should perhaps be added to the list of things for rechartering.   There are a lot of interactions and posable security side effects that need to be looked at.

John B.

> On Nov 21, 2015, at 9:55 AM, nov matake <> wrote:
> Hi OAuthers,
> I’m thinking the way to issue refresh tokens both to native app and its backend server at same time.
> I have 2 ideas currently.
> 1. including 2 audience in a single authorization code, and allow using the code once per the audience.
> 2. issuing 2 code one for native app, one for backend server.
> 1st way means code can be used twice, so it can break RFC6749.
> 2nd way means defining another code (ex. code_for_backend etc.)
> Does someone has implementation supporting such use-case?
> —
> nov
> _______________________________________________
> OAuth mailing list