Alessio Caiazza
https://abisso.org/
•
Nov 26
WeChat ID
aaronpk_tv
Thursday, November 26, 2020
-
-
This is a great idea! -
Peter Holz
https://twitter.com/nu4ur
•
Nov 26
Hi @aaronpk, do you know if any OAuth provider like Okta allows to set refresh tokens as HttpOnly cookie and whose token endpoint reads that cookie? Asking for a browser-based public client which can't safely store refresh tokens outside of memory otherwise.
That's non-standard behavior so I'm not sure anyone is doing that. But there is some discussion about bringing this idea into the working group for standardization. -
-
-
Peter Holz
https://twitter.com/nu4ur
•
Nov 26
Thanks! Rotation doesn't help against the theft itself, only alerts afterwards. I'm not familiar with sender constraints, but probably difficult to implement for public clients? Cookies would be a simple and proven solution, at least for *browser-based* public clients.
Yep I agree, there's a draft I'm planning on taking to the group to suggest exactly this.
