OAUTH2_TOKEN_REPLAY security auth_error ai_generated partial

OAuth2 token replay detected: the same access token was used from two different IP addresses within a short time window

ID: security/oauth2-token-replay-detected

Also available as: JSON · Markdown · 中文
75%Fix Rate
82%Confidence
1Evidence
2024-01-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Keycloak 22.0.0 active — — —
Okta 16.0.0 active — — —
Auth0 3.0.0 active — — —
Spring Security OAuth2 6.2.0 active — — —

Root Cause

An attacker has stolen a valid access token and is using it from a different IP address, or a legitimate user's token is being used from multiple locations due to a misconfigured proxy or VPN.

generic

中文

攻击者窃取了有效的访问令牌并从不同的IP地址使用它，或者合法用户的令牌因代理或VPN配置错误而从多个位置使用。

Official Documentation

https://oauth.net/2/token-replay/

Workarounds

  1. 80% success Implement token binding by issuing tokens that are bound to the client's TLS session or device fingerprint. For example, use JWT 'cnf' claim with a certificate thumbprint. 
    Implement token binding by issuing tokens that are bound to the client's TLS session or device fingerprint. For example, use JWT 'cnf' claim with a certificate thumbprint.
  2. 85% success Use short-lived access tokens (e.g., 5 minutes) and refresh tokens with rotation to minimize the window for replay attacks. Configure your identity provider accordingly. 
    Use short-lived access tokens (e.g., 5 minutes) and refresh tokens with rotation to minimize the window for replay attacks. Configure your identity provider accordingly.
  3. 70% success Monitor and alert on suspicious token usage patterns, such as rapid IP changes, and automatically revoke the token and require re-authentication. 
    Monitor and alert on suspicious token usage patterns, such as rapid IP changes, and automatically revoke the token and require re-authentication.

中文步骤

  1. 通过将令牌绑定到客户端的TLS会话或设备指纹来实现令牌绑定。例如，使用带有证书指纹的JWT 'cnf'声明。
  2. 使用短生命周期的访问令牌（例如5分钟）和带轮换的刷新令牌，以最小化重放攻击的窗口。相应地配置身份提供者。
  3. 监控并告警可疑的令牌使用模式，例如IP快速变化，并自动撤销令牌并要求重新认证。

Dead Ends

Common approaches that don't work:

  1. 50% fail

    Blocking the IP address of the second request is ineffective because attackers often use rotating IP addresses or proxies, and it may also block legitimate users behind NAT.

  2. 60% fail

    Increasing the time window for replay detection may reduce false positives but also gives attackers more time to use the stolen token, increasing the risk.

  3. 90% fail

    Disabling replay detection entirely removes the security control, leaving the system vulnerable to token theft and replay attacks.