4

Following this section on RFC 6749, the Authorization Server MUST NOT issue a refresh token for Implicit Grant flow.

https://www.rfc-editor.org/rfc/rfc6749#page-35

I'm planning to use Implicit Grant flow with Refresh Token in a single page application, avoiding to request a new authorization process for user each time the access token expires.

Could anybody to clearify the reason for this constraint in RFC ?

Thanks :)

1 Answer 1

5

Eduardo, In the implicit grant flow, the client is requesting access to a resource by way of a "User Agent", aka browser from the user. So a client wants to grab something, but needs the user to enter permissions for it. If the auth server provided a refresh token, then the client could skip asking the user for permission in the future and grant itself access forever (essentially reupping its token whenever it wants without user permission). So they forbid it in the flow because the "untrusted" client should only have access by way of having the user enter their credentials (thus only when the resource owner allows it).

2
  • So it's ok to issue refresh tokens for Resource Owner flow but not Implicit? Why is it OK in Resource Owner but not Implicit?
    – Rob L
    Commented Aug 29, 2017 at 18:26
  • 1
    For Resource Owner, you are trusting the client to manage your credentials (the RFC says "the resource owner has a trust relationship with the client"). That basically means you can enter your credentials directly in the application. Because you trust the client, the client can "refresh" your access token on your behalf - so refresh tokens are allowed. In the implicit flow, the resource owner (user) doesn't trust their credentials in the app (some third party website/app) - so you don't want that third party to ever refresh the token.
    – jeremyh
    Commented Aug 29, 2017 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.