In this article, we investigate the security properties of refresh tokens in the browser. We investigate why frontend web applications need refresh token rotation and what we gain by using refresh token rotation. Next, we dive into concrete attack scenarios that bypass refresh token rotation and discuss how sensitive SPAs should use a backend-for-frontend to secure tokens.

9 April 2021 OAuth 2.0 & OpenID Connect OAuth 2.0, XSS, Single Page Applications, Refresh tokens

Traditionally, OAuth 2.0 applications rely on iframes to silently obtain tokens in the background while the application remains running in the foreground. With the ongoing efforts to block third-party cookies, these flows become increasingly unreliable. Use the new version of the Flow Simulator to visualize the effects of third-party cookie blocking in Brave and Safari.

24 November 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Online Courses, Flow Simulator

Have you ever heard of the device flow, or the OAuth 2.0 Device Authorization Grant? If not, make sure you keep reading, as the device flow is pretty awesome to support an ever-growing group of applications. If you already know about the device flow, you should skip to the second half of the article, where we discuss the details and the surprising amount of security benefits.

18 August 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Authentication

I often need to explain the different steps in OAuth 2.0 and OpenID Connect flows, for example during a training or consulting session. Illustrating the numerous steps with a real-world application is always challenging, especially since many of the requests are invisible to the user. That's why I built the Flow Simulator, which allows you to walk through a flow step by step, while visualizing all the relevant details. Keep reading to learn all about the publicly available Flow Simulator.

7 July 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Online Courses, Flow Simulator

Everyone who first learns about OAuth 2.0 and OpenID Connect is confused. There are dozens of specifications with uncommon terminology and hard-to-understand scenarios. That's why I am excited to announce this free introductory course, which is the perfect starting point for your journey into OAuth 2.0 and OpenID Connect. More details are available in this article.

1 July 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Online Courses

About a year ago, the OAuth 2.0 Implicit flow became deprecated. That decision caused a lot of confusion and frustration. In this article, we analyze the different OAuth 2.0 flows to find out why the OAuth working group made that decision. Read on to find out about current best practices for using OAuth 2.0 in modern web applications.

7 May 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, PKCE, Single Page Applications

Single Page Applications can use refresh tokens in the browser. Yes, you read that right. This new development is awesome, because it makes access token renewal much more elegant. However, refresh tokens in the browser require additional security measures, such as refresh token rotation. We discuss the pros and cons of refresh token rotation, along with the potential dangers. In the end, you will find five strategies you can use to secure your tokens in your web frontends better.

30 April 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, Refresh tokens, XSS

Most developers are afraid of storing tokens in LocalStorage due to XSS attacks. While LocalStorage is easy to access, the problem actually runs a lot deeper. In this article, we investigate how an attacker can bypass even the most advanced mechanisms to obtain access tokens through an XSS attack. Concrete recommendations are provided at the end.

16 April 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, LocalStorage, XSS