On Thu, Jul 8, 2010 at 11:53 AM, Kris Selden <[email protected]> wrote: > The refresh token is key to separating concerns of the protected resource > from the auth server. > > I think this is succinctly explained the original rationale (refresh token = > refresh secret): > http://wiki.oauth.net/ScalableOAuth#Appendix
That suggests security issues. If I use tokens that can be used to access protected resources for extended periods of time, why can't I just revoke the compromised tokens (possibly all of them) when a leak is discovered? It seems somewhat convoluted to introduce a new system and then just wait until a timeout happens (although that timeout may be acceptably small)... I do not understand how it separates concerns more than they were already separated under OA1.0a. Under OA1.0a, if I understand correctly, the auth server produces tokens, and the protected resource consumes them. That feels like two separate concerns to me. cheers Laurens _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
