10.4. 刷新令牌(10.4. Refresh Tokens)

10.4. 刷新令牌

授权服务器可以给Web应用客户端和本机应用程序客户端颁发刷新令牌。

刷新令牌在传输和储存时必须保持机密性，并只与授权服务器和刷新令牌被颁发的客户端共享。授权服务器必须维护刷新令牌和它被颁发给的客户端之间的绑定。刷新令牌必须只能使用带有RFC2818定义的服务器身份验证的1.6所述的TLS 传输。 授权服务器必须验证刷新令牌和客户端身份之间的绑定，无论客户端身份是否能被验证。当无法进行客户端身份验证时，授权服务器应该采取其他手段检测刷新令牌滥用。

例如，授权服务器可以使用刷新令牌轮转机制，随着每次访问令牌刷新响应，新的刷新令牌被颁发。以前的刷新令牌被作废但是由授权服务器保留。如果刷新令牌被泄露，随后同时被攻击者和合法客户端使用，他们中一人将提交被作废的刷新令牌，这将通知入侵给授权服务器。

授权服务器必须确保刷新令牌不能被生成、修改或被未授权一方猜测而产生有效的刷新令牌。

 

10.4. Refresh Tokens

   Authorization servers MAY issue refresh tokens to web application
   clients and native application clients.

   Refresh tokens MUST be kept confidential in transit and storage, and
   shared only among the authorization server and the client to whom the
   refresh tokens were issued.  The authorization server MUST maintain
   the binding between a refresh token and the client to whom it was
   issued.  Refresh tokens MUST only be transmitted using TLS as
   described in Section 1.6 with server authentication as defined by
   [RFC2818].

   The authorization server MUST verify the binding between the refresh
   token and client identity whenever the client identity can be
   authenticated.  When client authentication is not possible, the
   authorization server SHOULD deploy other means to detect refresh
   token abuse.

   For example, the authorization server could employ refresh token
   rotation in which a new refresh token is issued with every access
   token refresh response.  The previous refresh token is invalidated



Hardt                        Standards Track                   [Page 55]

---

 
RFC 6749                        OAuth 2.0                   October 2012


   but retained by the authorization server.  If a refresh token is
   compromised and subsequently used by both the attacker and the
   legitimate client, one of them will present an invalidated refresh
   token, which will inform the authorization server of the breach.

   The authorization server MUST ensure that refresh tokens cannot be
   generated, modified, or guessed to produce valid refresh tokens by
   unauthorized parties.