Review accessToken and refreshToken behavior in other implementations

[ilopmar]

According to the RFC: https://tools.ietf.org/html/rfc6749#section-1.4

Access tokens are credentials used to access protected resources

https://tools.ietf.org/html/rfc6749#section-1.5

Refresh tokens are credentials used to obtain access tokens

This implies that refresh tokens shouldn't be valid to access resources but only to get new access tokens.

At this moment Micronaut allows to access to resources using accessTokens.

Review how other implementations manage this.

[julKali]

I would suggest one of the following two options:

• reserve a special role for refresh tokens, i.e. _REFRESH
• add a scope object to the token and move the roles declaration into scope. Only access tokens have the roles property, refresh tokens have a property refresh set to true. See example below.

access token:

{
  "sub": "example",
  "nbf": 1580119425,
  "scope": {
    "roles": [
      "GENERAL"
    ],
  },
  "exp": 1580123025,
  "iss": "mnuserauth",
  "iat": 1580119425
}

refresh token:

{
  "sub": "example",
  "nbf": 1580119425,
  "scope": {
    "refresh": true
  },
  "iss": "mnuserauth",
  "iat": 1580119425
}

[sdelamo]

I've checked both Okta and Auth 0 and they don't use JWT as refresh tokens.