Repository navigation
Adding Claims in Refresh Token is not supported in Keycloak ? #14840
pranavsurwade
started this conversation in
Archive
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
As we know that Keycloak doesn't provide any way to add claims for refresh token, we can only add claims in access token, which results in lack of security issue as using refresh token of another user, one can get access to all API. I better approach to solve it is to add claims in refresh token and enhance security.
All reactions
Replies: 1 comment · 2 replies
Uh oh!
There was an error while loading. Please reload this page.
A refresh token should be bound to the user for which it was issued. And it is not intended to provide any claims which evaluated by a resource server (API).
RFC 6749, Section1.5
How could you use a refresh token to get an access token for a different user?
All reactions
Uh oh!
There was an error while loading. Please reload this page.
What approach could be used to bound refresh token to a particular user ?
What we can do to stop the exploitation of refresh token, if it get's used by another user .
All reactions
Uh oh!
There was an error while loading. Please reload this page.
This is nothing you need to worry about. A refresh token can not be used to get an access token for a different user. It's only purpose is to get a fresh access token for the same recource owner (user) as in the access token which was handed out together with the refresh token.
You did not provide any scenario where a refresh token is used for an exploit.
All reactions