Repository navigation
Replies: 1 comment 1 reply
|
To get a new access token you have to use a refresh token. The number says how often you can use the refresh token to get a new access token. "0" means you can use the refresh token only once. Note that if you set it to "0" you can use only a single browser tab for your application, see #14122. |
1 reply
|
@cm253 Thanks for the response. I understand the implications of setting the 'Refresh Token Max Reuse' value to zero. What I am concerned about is the security implications of setting it to a non-zero value. To me, it seems wrong to be able to set the 'Refresh Token Max Reuse' value to a non-zero value without a time limit on those reuses. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
When the 'Revoke Refresh Token' option is set to 'On', we can then set a 'Refresh Token Max Reuse' value. By default this value is zero. What the security implications if this 'Refresh Token Max Reuse' value is set to a non-zero value?
I would presume that this would allow the possibility for a replay attack of the refresh token. I notice that Auth0 has the option to specify a very short window of time (say, 15 seconds) within which refresh tokens can be reused, and outside of which the attempt would end the session.
All reactions