OAUTH2_TOKEN_REUSE_DETECTION_FAILURE security auth_error ai_generated true

OAuth2 token reuse detection failure allows replay attack

ID: security/oauth2-token-reuse-detection-failure-allows-replay-attack

Also available as: JSON · Markdown · 中文
89%Fix Rate
81%Confidence
1Evidence
2024-02-14First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
OAuth2.0 active — — —
Spring Security 5.6+ active — — —
Keycloak 22.0.0 active — — —
Auth0 2024.02 active — — —

Root Cause

When the authorization server does not track whether an authorization code or access token has already been used, an attacker can replay a captured token to gain unauthorized access.

generic

中文

当授权服务器未跟踪授权代码或访问令牌是否已被使用时，攻击者可以重放捕获的令牌以获得未经授权的访问。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc6749#section-10.5

Workarounds

  1. 95% success Implement token reuse detection on the authorization server: store a flag or timestamp for each authorization code and access token, and reject requests that use an already-used code or token. Example in Spring Security: configure OAuth2AuthorizationService with a persistent store that marks codes as used. 
    Implement token reuse detection on the authorization server: store a flag or timestamp for each authorization code and access token, and reject requests that use an already-used code or token. Example in Spring Security: configure OAuth2AuthorizationService with a persistent store that marks codes as used.
  2. 90% success Use short-lived authorization codes (e.g., 1 minute) and access tokens (e.g., 5 minutes) combined with reuse detection to minimize the replay window. 
    Use short-lived authorization codes (e.g., 1 minute) and access tokens (e.g., 5 minutes) combined with reuse detection to minimize the replay window.
  3. 85% success Implement token binding (e.g., via DPoP or mTLS) to tie tokens to a specific client, preventing replay from other clients. 
    Implement token binding (e.g., via DPoP or mTLS) to tie tokens to a specific client, preventing replay from other clients.

中文步骤

  1. Implement token reuse detection on the authorization server: store a flag or timestamp for each authorization code and access token, and reject requests that use an already-used code or token. Example in Spring Security: configure OAuth2AuthorizationService with a persistent store that marks codes as used.
  2. Use short-lived authorization codes (e.g., 1 minute) and access tokens (e.g., 5 minutes) combined with reuse detection to minimize the replay window.
  3. Implement token binding (e.g., via DPoP or mTLS) to tie tokens to a specific client, preventing replay from other clients.

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Relying on short token lifetimes (e.g., 5 minutes) does not prevent replay within that window; an attacker can replay the token immediately after capture.

  2. 60% fail

    Using a nonce in the request is insufficient if the authorization server does not track nonces per token; an attacker can reuse the same nonce.

  3. 50% fail

    Encrypting the token does not prevent replay because the attacker can still send the same encrypted token.