Consider changing default options related to refresh tokens

[josephdecock]

Consider changing to the following defaults:

• Turn on the Token Cleanup Job
• Enable cleanup of consumed tokens in the cleanup job
• Change RefreshTokenUsage to ReUse
  • Perhaps make the default depend on if we have a public or private client. Public clients get one time only, private get reusable. I think we can determine if clients are private based on the presence of a client secret, right?

[josephdecock]

I think we want these as defaults to reduce the size of the persisted grants table, but as they are potentially destructive changes, it belongs in 7.0.

[leastprivilege]

Idea: "add a config switch to emit a warning if a public client is configured with re-used refresh tokens" - turned on by default

[josephdecock]

After more discussion, the plan is to:

• Emit a warning when using rotated refresh tokens
• Default to ReUse tokens

[mottykohn]

Hi, just wondering, why was this change made?
Thanks

[josephdecock]

@mottykohn, thanks for your question! I've added the following explanation to our release notes:

Rotated refresh tokens have historically been encouraged (and been our default), however more recent guidance from the IETF and our own experience have shown that rotation is not usually helpful from a security point of view but is actively harmful to the user experience and produces greater load on the data store.

Rotation of refresh tokens often does not improve their security because a sophisticated attacker can observe the rotation happening while the user is active, and only make use of the final token after the user is no longer active. See OAuth for Browser Based Apps for more details on this sort of attack.

Rotation harms the user experience, because if the token is rotated, but the network response with the new token fails, the user will have to log in again.

Rotation adds pressure on the data store because each time the token rotates, the old record must be updated and a new record written.

Given all these considerations, we have changed our default for RefreshTokenUsage to ReUse.