Repository navigation
Adding Claims in Refresh Token is not supported in Keycloak ? #14840
Replies: 1 comment 2 replies
|
A refresh token should be bound to the user for which it was issued. And it is not intended to provide any claims which evaluated by a resource server (API).
How could you use a refresh token to get an access token for a different user? |
|
What approach could be used to bound refresh token to a particular user ? |
|
This is nothing you need to worry about. A refresh token can not be used to get an access token for a different user. It's only purpose is to get a fresh access token for the same recource owner (user) as in the access token which was handed out together with the refresh token. You did not provide any scenario where a refresh token is used for an exploit. |
Uh oh!
There was an error while loading. Please reload this page.
As we know that Keycloak doesn't provide any way to add claims for refresh token, we can only add claims in access token, which results in lack of security issue as using refresh token of another user, one can get access to all API. I better approach to solve it is to add claims in refresh token and enhance security.
All reactions