Skip to content
Hallway
0:00 / 0:00

#oauth#refreshtokens#sessionhijacking

Detecting session hijacking using rotating refresh tokens - OSW 2020

OAuth Security Workshop

312 subscribers • 1 video on Hallway

YouTube
  • Recommended by 1 person: 1 in engineering communities.
  • Presented by Rishabh Poddar
  • May be out of date. Uploaded 6 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

3.3K views6 years ago1 recommendation

SecurityWeb developmentWeb and application securityHTTP, REST and GraphQL

Rishabh Poddar discusses how to detect and prevent session hijacking using rotating refresh tokens as recommended by the IETF.

Presented by Rishabh Poddar at the OAuth Security Workshop 2020. Session hijacking is one of the oldest, yet unsolved, attack vectors to gain unauthorised access to a user’s account. As apps are employing more secure login techniques like 2FA or passwordless login, we expect session based attacks to grow in the coming years. As a recent example, many Youtube influencers’ accounts were hijacked via a malware that stole their session tokens. This enabled the attackers to gain access to the youtubers’ accounts even though they had 2FA enabled. Most commonly, developers resort to IP address / device fingerprinting patter matching in order to suspect token theft. However, this has the problem of many false positives leading to really bad UX. I will be discussing a method called ""rotating refresh tokens"" to better detect token theft. This is also a method recommended by the IETF in their RFC 6819. Whilst this can be conceptually straightforward to understand, implementing it reliably and in a way that scales is non trivial. Specifically, there are many race conditions and network failure issues that need to be solved for. To make this approach scale (in terms of time and space complexity) as well as traditional methods, we also need to use a unique token formation technique which I will be discussing. My talk will be inspired by my blog post: supertokens.io/blog/the-best-way-to-securely-manage-user-ses…

Why it's here

1 person recommends this

What people say. Recommended for understanding how rotating refresh tokens work to secure sessions and prevent token theft.

Moments people linked to

u/ilovefunctionsin r/node • Recommends

On “Securing Refresh tokens”

> I was thinking of a scenario, where if both my access and refreshTokens are stolen, what can be done in that case.? You want to use "rotating refresh tokens" - essentially, this is when a new refresh token is generated each time the older one is used. Checkout this video: link to this video > Is there any way to recognize that a user has signed in from a different device? Yea... you issue one set of access / refresh tokens per device and you store that info somehow in your db. If a user has multiple such sets, they have logged into multiple devices. > We usually see mails when there is a new sign in to say google, or FB, but how can it be achieved on a very high level in node? You keep track of…
11View on Reddit

u/ilovefunctionsin r/node • Recommends

On “Auth micoservices : when to "renew" a refresh token?”

What you want to achieve is called rotating refresh tokens. This is a relatively new, but a well-documented concept. Essentially, you want to issue a new access & refresh token each time the current access token expires. This is a video that explains how this works and how it compares with other simpler (but less secure) flows. That being said, to get this right is not easy. While you may seem to think it works, unless you tackle all the race conditions correctly, the system will fail under moderate / high traffic. So I would look for an existing solution that implements this. As per my knowledge, there are only two providers for this: Auth0 and SuperTokens.io
1View on Reddit