Reuse or revoke existing or access and refresh tokens on new auth about oauth2-server HOT 10 CLOSED

There is nothing on this in the spec as far as I'm aware but I don't think there needs to be. Once a client has an access token, why would they go through the process again?

from oauth2-server.

There is nothing on this in the spec as far as I'm aware but I don't think there needs to be. Once a client has an access token, why would they go through the process again?

If they logged in on another computer. We are building a Desktop App and its very common for the same account to be used on multiple workstations.

from oauth2-server.

@ctadlock tihs is refresh token rotation.

from oauth2-server.

@ctadlock tihs is refresh token rotation.

Thanks. Its related, but not exact.

To simplify my question.. is it OK for the same user/client pair to have multiple unexpired and unrevoken access and refresh tokens?

Im using a modified version of Laravel Passport and it even has code to check to see if a valid token exists, but it only uses it to bypass the authorization step. It then gets handed off to this package which always issues new tokens without regard to any existing active tokens.

https://github.com/laravel/passport/blob/286baeb1be934654fe4eef147b24d3c8a9a3e08d/src/Http/Controllers/AuthorizationController.php#L101

from oauth2-server.

is it OK for the same user/client pair to have multiple unexpired and unrevoken access and refresh tokens?

No, it isn`t. There are some considerations not to do so.

You can use multiple token pairs to organize multiple user sessions but tokens must be renewed.

from oauth2-server.

That is what happens if you use this library with Laravel Passport. Its not clear to me if the fix would be in this library or Passport. It would seem to me given the code link I put in my first post that it should be in this library. Im not at a level of expertise to know yet, nor submit a PR to resolve it.

Here is the result from my system with the same user (account_id) being authorized to the same client (application_id) on two devices.

from oauth2-server.

If this is for a desktop app I think that app should ensure stored credentials are tied to the logged in user in much the same way as other desktop apps do. Is this not possible?

from oauth2-server.

If this is for a desktop app I think that app should ensure stored credentials are tied to the logged in user in much the same way as other desktop apps do. Is this not possible?

Many of the desktop apps I use use OAuth; GitKraken...

from oauth2-server.

Do they all definitely have shared credentials though? If I logged into your machine would Git Kraken allow me to have access to all your repos?

from oauth2-server.

Closing this as I think it is something your app needs to handle rather than this library

from oauth2-server.