Re: [OAUTH-WG] Refresh tokens security enhancement

Marius Scurtescu <mscurtescu@google.com> Tue, 04 May 2010 20:30 UTC

Return-Path: <mscurtescu@google.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C103A3A6A34 for <oauth@core3.amsl.com>; Tue, 4 May 2010 13:30:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -100.704
X-Spam-Level:
X-Spam-Status: No, score=-100.704 tagged_above=-999 required=5 tests=[AWL=-0.586, BAYES_20=-0.74, FM_FORGED_GMAIL=0.622, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PlwylWgM8mOl for <oauth@core3.amsl.com>; Tue, 4 May 2010 13:29:57 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.35]) by core3.amsl.com (Postfix) with ESMTP id 70E1A3A6AC0 for <oauth@ietf.org>; Tue, 4 May 2010 12:45:16 -0700 (PDT)
Received: from kpbe17.cbf.corp.google.com (kpbe17.cbf.corp.google.com [172.25.105.81]) by smtp-out.google.com with ESMTP id o44JixrA026917 for <oauth@ietf.org>; Tue, 4 May 2010 12:45:00 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1273002300; bh=j07DCt7CcNAqOjj1pwBJN87Q1rw=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=EM7KKs/lP9//op4CqQgoHseta+cRLijyMuLcYNGa20fdZYezZ7wzx3TCk/vBfPdhQ L3imV+aLWHTbs4MrlGefQ==
DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:from:date:message-id: subject:to:cc:content-type:x-system-of-record; b=ZvJQpubCCs/T2wegwNYKOccXBCDItQLbRkwMaaVUWqvU0FeJ1hZV/uuyw/7jlIh+2 KzQumPHdTXtO35DtbcH9g==
Received: from pxi15 (pxi15.prod.google.com [10.243.27.15]) by kpbe17.cbf.corp.google.com with ESMTP id o44JiwLi012562 for <oauth@ietf.org>; Tue, 4 May 2010 12:44:58 -0700
Received: by pxi15 with SMTP id 15so2134132pxi.28 for <oauth@ietf.org>; Tue, 04 May 2010 12:44:58 -0700 (PDT)
Received: by 10.141.13.11 with SMTP id q11mr4974454rvi.75.1273002298155; Tue, 04 May 2010 12:44:58 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.141.14.15 with HTTP; Tue, 4 May 2010 12:44:38 -0700 (PDT)
In-Reply-To: <4BE06831.60105@lodderstedt.net>
References: <C8044E24.2DAD6%atom@yahoo-inc.com> <4BE06831.60105@lodderstedt.net>
From: Marius Scurtescu <mscurtescu@google.com>
Date: Tue, 04 May 2010 12:44:38 -0700
Message-ID: <AANLkTinfr0-DlgB5rTZYnBhslolxfniVGvhoPY_N6y4Y@mail.gmail.com>
To: Torsten Lodderstedt <torsten@lodderstedt.net>
Content-Type: text/plain; charset="ISO-8859-1"
X-System-Of-Record: true
Cc: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Refresh tokens security enhancement
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 May 2010 20:30:02 -0000

On Tue, May 4, 2010 at 11:32 AM, Torsten Lodderstedt
<torsten@lodderstedt.net> wrote:
> Am 03.05.2010 18:55, schrieb Allen Tom:
>> Invalidating the Refresh Token (and presumably also invalidating any
>> outstanding Access Tokens) would make sense as an option for applications
>> that require a high level of security. However, I do not think that
>> invalidating the Refresh Token on every Refresh request should be required
>> in the spec - it should be an implementation specific detail.
>>
>
> It could be an optional feature of the spec (as many other features).

Torsten, can you please have a look a the "explicit request for
refresh token" thread?

Would a "refresh_token_type=single" parameter solve the above?


Marius