刷新令牌是否过期，如果是，何时过期? [英] Does the refresh token expire and if so when?

问题描述

我已阅读 PODIO 文档.我特别考虑了以下有关使用 refresh_token 的声明:

I have read the PODIO documentation. I have in particular contemplated the following statement concerning use of the refresh_token:

这个请求返回的数据和上面一样，可以继续一遍又一遍地执行此操作，以确保您的应用程序经过身份验证无需要求用户重新进行身份验证.

This request returns the same data as above, and you can continue to do this over and over again, to keep your application authenticated without having to ask the user to re-authenticate.

这是否意味着 refresh_token 将无限期有效或过期:

Does this mean that the refresh_token will be indefinitely valid or does it expire:

1. 发出X天后；或
2. 最后一次使用它获取新的 access_token 后 X 天

1. X days after being issued; or
2. X days after the last use of it for obtaining a new access_token

<小时>

请参阅此 PODIO线程提出了同样的问题，但似乎没有给出关于 Oauth2.0 协议的 PODIO 实现的任何结论性答案.

---

Please see this PODIO Thread which asks the same questions but does not seem to give any conclusive answers about the PODIO implementation of the Oauth2.0 protocol.

推荐答案

你的问题的答案:

这是否意味着 refresh_token 将无限期有效或会过期吗?

Does this mean that the refresh_token will be indefinitely valid or does it expire?

...可以从第1.5节和OAuth 2.0 规范的第 10.4 节.

第1.5节refresh_token状态介绍:

刷新令牌由授权服务器发给客户端并且用于在当前访问时获取新的访问令牌令牌无效或过期，或获得额外的访问权限具有相同或更窄范围的令牌(访问令牌可能具有比授权的生命周期更短，权限更少资源所有者)

Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope (access tokens may have a shorter lifetime and fewer permissions than authorized by the resource owner)

第 10.4 节 refresh_token 状态的安全注意事项:

授权服务器必须验证刷新之间的绑定令牌和客户端身份，只要客户端身份可以认证.当无法进行客户端身份验证时，授权服务器应该部署其他方法来检测刷新令牌滥用.

The authorization server MUST verify the binding between the refresh token and client identity whenever the client identity can be authenticated. When client authentication is not possible, the authorization server SHOULD deploy other means to detect refresh token abuse.

例如，授权服务器可以使用刷新令牌
每次访问都会发出一个新的刷新令牌的轮换
令牌刷新响应.之前的刷新令牌已失效，但由授权服务器保留.如果刷新令牌是
受到攻击并随后被攻击者和攻击者使用
合法客户端，其中之一将显示无效刷新
令牌，它将通知授权服务器违规.

For example, the authorization server could employ refresh token
rotation in which a new refresh token is issued with every access
token refresh response. The previous refresh token is invalidated but retained by the authorization server. If a refresh token is
compromised and subsequently used by both the attacker and the
legitimate client, one of them will present an invalidated refresh
token, which will inform the authorization server of the breach.

可以得出结论，如果authorization_server 能够验证refresh_token 和它被发给的客户端之间的绑定，那么refresh_token 可以用来获得多个access_token 并且永不过期.否则，授权服务器将使旧的 refresh_token 失效，并在每次访问令牌刷新响应时生成新的 refresh_token.

It can be concluded that if the authorization_server is able to verify the binding between a refresh_token and the client to whom it was issued then refresh_token can be used to obtain multiple access_token and will never expire. else the authorization sever will invalidate the old refresh_token and generate new refresh_token with every access token refresh response.

这篇关于刷新令牌是否过期，如果是，何时过期?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！