Re: [OAUTH-WG] Implementation questions around refresh token rotation

[[e-mail]]

Hey Aaron,

Auth0 does offer a configurable grace period, during which the “preceding” token can be reused. 

I am not 100% sure what we do in the exact scenario you described, and I will double check for you, but here’s my intuition.

 

The operation redeem(RT_n) should result in AT, RT_n+1. The grace period just extends the time in which the operation can occur, but every operation should be idempotent. All repeats of that operation within the grace period should have the same result, which means that every resulting RT is a representative of the RT_n+1 class, hence all valid at the same time. After the grace period elapses, RT_n is invalid, and that’s it.

So, in your example I would consider RT1.1 and RT1.2 as equivalent, as they are both representatives of the RT_n+1 equivalence class.

 

It would be very hard to do otherwise, given that network operations aren’t guaranteed to be concluded in the order they were executed without semaphores, and above all the network failures the grace period is designed to handle can apply to any of the requests, regardless of the order.

 

From: OAuth <[e-mail]> On Behalf Of Aaron Parecki
Sent: Tuesday, October 6, 2020 3:06 PM
To: OAuth WG <[e-mail]>
Subject: [OAUTH-WG] Implementation questions around refresh token rotation

 

Hi all, I have a couple questions for those of you who have implemented refresh token rotation...

 

Have you included the option of a grace period on refresh token use, allowing multiple uses within some time window? I'm wondering because a grace period where a refresh token may be used more than once would work around the problem that has been brought up, of a mobile app accidentally using a refresh token more than once during normal operation because different threads are unable to coordinate between themselves. However that also kind of defeats the purpose since attacks within that grace period would be hard to detect. I'm looking for an idea of where people have landed on that issue in practice.

 

If you have implemented a grace period, then how do you handle expiring the additional refresh tokens that have been granted? For example, if RT "R1" is used twice, resulting in new ATs "A1.1", "A1.2" and new RTs "R1.1" and "R1.2", what happens if "R1.2" is then later used? Would you invalidate "R1.1" at that point? If so, why, and if not, why not?

 

It would be most interesting to hear practical experience from people who have already built refresh token rotation into a system.

 

Thanks!




---

Aaron Parecki

https://aaronparecki.com