检测到OAuth2令牌重放：在短时间内从两个不同的IP地址使用了相同的访问令牌
OAuth2 token replay detected: the same access token was used from two different IP addresses within a short time window
ID: security/oauth2-token-replay-detected
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| Keycloak 22.0.0 | active | — | — | — |
| Okta 16.0.0 | active | — | — | — |
| Auth0 3.0.0 | active | — | — | — |
| Spring Security OAuth2 6.2.0 | active | — | — | — |
根因分析
攻击者窃取了有效的访问令牌并从不同的IP地址使用它，或者合法用户的令牌因代理或VPN配置错误而从多个位置使用。
English
An attacker has stolen a valid access token and is using it from a different IP address, or a legitimate user's token is being used from multiple locations due to a misconfigured proxy or VPN.
官方文档
https://oauth.net/2/token-replay/解决方案
-
通过将令牌绑定到客户端的TLS会话或设备指纹来实现令牌绑定。例如，使用带有证书指纹的JWT 'cnf'声明。
-
使用短生命周期的访问令牌（例如5分钟）和带轮换的刷新令牌，以最小化重放攻击的窗口。相应地配置身份提供者。
-
监控并告警可疑的令牌使用模式，例如IP快速变化，并自动撤销令牌并要求重新认证。
无效尝试
常见但无效的做法:
-
50% 失败
Blocking the IP address of the second request is ineffective because attackers often use rotating IP addresses or proxies, and it may also block legitimate users behind NAT.
-
60% 失败
Increasing the time window for replay detection may reduce false positives but also gives attackers more time to use the stolen token, increasing the risk.
-
90% 失败
Disabling replay detection entirely removes the security control, leaving the system vulnerable to token theft and replay attacks.