Re: [OAUTH-WG] Short lived access token and no refresh token

John Bradley <> Tue, 25 July 2017 16:02 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 2B129131D16 for <>; Tue, 25 Jul 2017 09:02:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id yINAbIM4PL4C for <>; Tue, 25 Jul 2017 09:02:48 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:400d:c0d::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 811D8126C2F for <>; Tue, 25 Jul 2017 09:02:48 -0700 (PDT)
Received: by with SMTP id s6so40724807qtc.1 for <>; Tue, 25 Jul 2017 09:02:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=y358Hs4WNjH7rLx9EAyJGR/QIZK9u+vIR769iFx/y40=; b=Klp9Z3GJ9B/Q3/JaJIglttfSmJtelheKkA7uk9XZiQ8mNAr/maa/rZWRp+WH5ulXOO 8JUxhchCUXYTp2l1LdiK9sEWFFJbDNrbTZYhFb4xEpP1Rsu6IZI8dQKJTfZXnCqkAgr1 +jIX8AY45D4iobxddxJns1a0N5njvv2U//Ehf8XNKJYkVZmYtj+xYuzCWy4ulzFeZFbk /IW2BOWxyJ2+1f/nlAAC4Xg45YIsQz8/8wknp9NITYqC8H5QtROvo2R3CaCnyeDVbJNE uvZcNKMBsFBs7NlmvXJeyrdxEAjv18FIN1abiIjrmbcK4W0Sc1rIltrboDMb4NvHkJJX dgkQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=y358Hs4WNjH7rLx9EAyJGR/QIZK9u+vIR769iFx/y40=; b=XIFxJwUV/sE3RnBO3ll9+PHcBXNbN0EFW9NlwiC2f2eAEIle6g46/v+Vj0W4kVfOBR n2x8/MdCwKNQ0ra1SVFEVXYql5fkc54EsFR52RaNr1fN/HQSaT952xrctXTb+VpaHz3Y EPpcKZajWPo9um/1hgoHIs6l+UOINOTNZHAzatdZzVK8xlXl+dbW+/MHudETXU2L6oby RuRhZushCD3r6wZsW8l74scNtERP4z6cXU8CN5lC0G2RiAQJOSNS/6FFos6WOXlyXv1n ncZO53iYNCjj4uewXA2wJQrBIzxnBwo5XAf9vszwW1cyMOOxq7tublg2kBw1hsnxc9n2 BOXg==
X-Gm-Message-State: AIVw110cOpyqIRKdPHEfK2Nl+M+ZfZ+/N4iV0q2SzHINQ3GuZdT4uf49 cp9IvKXto0BSNu7D
X-Received: by with SMTP id a28mr20731965qte.110.1500998567180; Tue, 25 Jul 2017 09:02:47 -0700 (PDT)
Received: from [] ([]) by with ESMTPSA id f20sm2589163qta.58.2017. (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 25 Jul 2017 09:02:46 -0700 (PDT)
From: John Bradley <>
Message-Id: <>
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Tue, 25 Jul 2017 12:02:37 -0400
In-Reply-To: <>
To: Bill Burke <>
References: <> <>
X-Mailer: Apple Mail (2.3273)
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="001a11c01fcc6fcab9055526766b"
Archived-At: <>
Subject: Re: [OAUTH-WG] Short lived access token and no refresh token
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 25 Jul 2017 16:02:51 -0000

Max-age has to do with user re-auth in connect.

Some AS only give refresh tokens if a scope of offline_acess or some such special scope is requested.
There is no standard scope for that.

I don’t know of any way for the client to control the lifetime of the access token other than by revoking it with the AS. <>

Depending on the AS you should be able to control the AT lifetime on a per client basis.

John B.

> On Jul 25, 2017, at 11:37 AM, Bill Burke <> wrote:
> For browser apps, implicit flow provides an access token but no refresh token.  For non-browser apps only client credentials grant doesn't supply a refresh token.  As for token access times, I believe only extensions to OAuth define those types of capabilities.  i.e. OpenID Connect defines a "max-age" claim that you can pass when requesting a token.
> On 7/25/17 10:48 AM, Saurav Sarkar wrote:
>> Hi All,
>> We have a scenario where one of our stakeholder wants to mandatorily initiate the authentication at certain point of time.
>> As per <>
>> there can be an option where access token is set for certain time and refresh token is not set. So we want to explore this option for this scenario.
>> I have couple of questions regarding this
>> (a) Is this  option part of OAuth 2 specification ? If yes can you please point me to the exact IETF link ?
>> (b) Is there any other way our scenario can be achieved ? We want this scenario to be supported from the authorization server (platform) itself and not in the client app or resource server.
>> Thanks and Best Regards,
>> Saurav
>> _______________________________________________
>> OAuth mailing list
>> <>
>> <>
> _______________________________________________
> OAuth mailing list