L30 · OAUTH 2.0
Refresh, then replay
Refresh an access token, then present the replaced refresh token again and watch the whole chain stop working.
Planned
Steps
Run the code flow for a client allowed to use refresh tokens, requesting offline access.
What the server will check: A token exchange that issued a refresh token.
Exchange the refresh token for a new access token with curl.
What the server will check: A successful refresh that returned a replacement refresh token.
Present the original refresh token again.
What the server will check: The reused refresh token was rejected.
Only one party should hold the newest refresh token. Seeing an old one again suggests a copy exists.
Try the replacement refresh token.
What the server will check: The replacement was also rejected.
Your tenant revokes the whole chain when it detects reuse, so the thief and the legitimate client both have to start again.
When it opens
This lab is planned. It opens when these are in place:
- Lab setup and cleanup in your test tenant
- The lab callback page
The server checks your test tenant's history for this attempt. You can review the events yourself in your tenant's Audit and Logs.