# OAuth2 token reuse detection failure allows replay attack

- **ID:** `security/oauth2-token-reuse-detection-failure-allows-replay-attack`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `OAUTH2_TOKEN_REUSE_DETECTION_FAILURE`
- **Verification:** ai_generated
- **Fix Rate:** 89%

## Root Cause

When the authorization server does not track whether an authorization code or access token has already been used, an attacker can replay a captured token to gain unauthorized access.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth2.0 | active | — | — |
| Spring Security 5.6+ | active | — | — |
| Keycloak 22.0.0 | active | — | — |
| Auth0 2024.02 | active | — | — |

## Workarounds

1. **Implement token reuse detection on the authorization server: store a flag or timestamp for each authorization code and access token, and reject requests that use an already-used code or token. Example in Spring Security: configure OAuth2AuthorizationService with a persistent store that marks codes as used.** (95% success)
   ```
   Implement token reuse detection on the authorization server: store a flag or timestamp for each authorization code and access token, and reject requests that use an already-used code or token. Example in Spring Security: configure OAuth2AuthorizationService with a persistent store that marks codes as used.
   ```
2. **Use short-lived authorization codes (e.g., 1 minute) and access tokens (e.g., 5 minutes) combined with reuse detection to minimize the replay window.** (90% success)
   ```
   Use short-lived authorization codes (e.g., 1 minute) and access tokens (e.g., 5 minutes) combined with reuse detection to minimize the replay window.
   ```
3. **Implement token binding (e.g., via DPoP or mTLS) to tie tokens to a specific client, preventing replay from other clients.** (85% success)
   ```
   Implement token binding (e.g., via DPoP or mTLS) to tie tokens to a specific client, preventing replay from other clients.
   ```

## Dead Ends

- **** — Relying on short token lifetimes (e.g., 5 minutes) does not prevent replay within that window; an attacker can replay the token immediately after capture. (70% fail)
- **** — Using a nonce in the request is insufficient if the authorization server does not track nonces per token; an attacker can reuse the same nonce. (60% fail)
- **** — Encrypting the token does not prevent replay because the attacker can still send the same encrypted token. (50% fail)