CODEWITHSUNDEEP
oauth-2.0
Geert-Jan
Geert-Jan

Reputation: 18895

Is it allowed per the oAuth2 specs to have multiple valid tokens per Resource Owner at the same time?

According to the oAuth2 specs, Is it allowed to have multiple valid tokens per Resource Owner at the same time?

For security considerations it seems appropriate (less exposed area for replay attacks) that only 1 active token per Resource Owner (i.e: User) is available. This would mean that when a new access token is requested for a Resource Owner the existing/old one (if exists) should be revoked.

I can't find any mention of this mechanism. Can someone clarify? Thanks.

Upvotes: 1

Views: 644

Answers (1)

Zólyomi István
Zólyomi István

Reputation: 2441

I've seen no such restriction in the standard. Having multiple tokens absolutely makes sense and may even improve security for tokens with different scopes. Consider a scenario when the client starts with some basic privileges (e.g. read-only access) and asks for elevated privileges for sensitive operations (e.g. write access). This is very similar to "run as root/admin" in linux/win systems.

Consequently, having multiple tokens with different scopes can make a system more secure if a single token is stolen.

Upvotes: 2

Related Questions