OAuth 2 Refresh Token Implementation

2
votes

I'm trying to figure out the proper flow and usage of Refresh Tokens with respect to the OAuth2 spec and I am completely stumped on how a specific use-case is supposed to work.

My main issue is, if I receive a refresh token from some OAuth provider (in this case Google), I have two problems I don't know how to solve:

  1. How do I persist the refresh token securely so that it can be used to obtain new tokens to keep a user logged in?
  2. How do I determine who the user is who needs a refresh token? I can't just have an endpoint that takes in old tokens or email addresses to issue a refreshed token because that seems incredibly dumb.

Quick image detailing oauth flow I am referring to

I believe I am considering some small implementation details incorrectly and I just don't want my backend API to be open to some massive security hole if I can prevent it by asking the helpful people of StackOverflow how this is actually supposed to work.

I should add that the only solution that seems semi-plausible is using some sort of timed refresh mechanism but that would involve having access to the refresh-token on the frontend, which I am trying to avoid since that in itself seems like a security risk.

I am concerned about best practices here, so if my entire implementation is flawed and I should be doing X instead of Y or Z then I'm open to suggestions too.

Thanks for your time,

Ses

1
oauthoauth-2.0google-oauthrefresh-token
Check this. – Edgar Ramírez Mondragón

1 Answers

0
votes

How do I persist the refresh token securely so that it can be used to obtain new tokens to keep a user logged in?

You can save the refresh token some place and just use it to get a new access token when ever you need to.

How do I determine who the user is who needs a refresh token? I can't just have an endpoint that takes in old tokens or email addresses to issue a refreshed token because that seems incredibly dumb.

I think you are confusing authentication with authorization.

Oauth2 grants your application authorization to access a users data. When you use the refresh token there is no authentication involved there is no way to know who is preforming the action. Oauth2 does not authenticate in any way that the user is preforming the action, oauth2 is your application preforming an action on the behalf of a user with their authorization. That does not ensure that the user is present when the action is preformed.

For that you would need to use Openid connect and use an id token to identify the user who is using your application.