29 ms·
One thing to be aware of with OAuth 2.0 is Refresh Tokens. If the spec is followed, the Refresh Tokens are long-lived and never expire (the spec makes a suggest
by fyfy18 9y ago
One thing to be aware of with OAuth 2.0 is Refresh Tokens. If the spec is followed, the Refresh Tokens are long-lived and never expire (the spec makes a suggestion that you revoke used tokens, but it's not required), so if they are leaked you are in for a bad time.
There's an RFC that goes into some of the security considerations of OAuth 2.0, that should be required reading if you implement it (even from a pre-built library): https://tools.ietf.org/html/rfc6819 https://tools.ietf.org/html/rfc6819
- Fradow 9y agoIf the Refresh Tokens are leaked, you revoke them and the user has to re-authenticate. It's crucial that clients are able to respond to their refresh tokens being revoked. The good thing is that it is a standard workflow, contrary to API key being revoked, which is generally not handled (most people hard-code API key in their client).
- imtringued 9y agoWhat's the appeal of tokens that never expire? You cannot delete the revokations after the token has expired.