If I understand this report correctly, you are worried that a malicious browser extension has full control over a site's refresh tokens? And you are specifically worried that detecting this via refresh token rotation leads to a potential DoS/annoyance for the user? This feels like the least bad part of that scenario to me, and very much working as designed. Such an attacker can likely just directly revoke the refresh token rather than relying on RTR to make that happen as a side-effect.
The browser-based apps BCP doesn't consider malicious browser extensions. Perhaps the authors could chime in here, but I would suspect it is because the threat model is too strong: there is really very little you can do to protect against such an attacker. -- Neil > On 15 Aug 2026, at 14:33, 이지용/학생/컴퓨터공학 <[email protected]> wrote: > > Hello, > > I am sharing a short report on an availability implication of refresh token > rotation in browser-based applications. > > The report includes the threat model, abuse flow, practical evaluation, and a > discussion of its implications for browser-based application guidance. > > I would appreciate any feedback on whether the threat model and availability > framing are appropriate for the WG’s consideration. > > Best regards, > JiYong Lee. > <WG_Report.pdf>_______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
