Welcome to Cycubix Docs
  • Welcome to Cycubix Docs
  • Our Cybersecurity Training Courses
  • Application Security Series
    • Web Application Security Essentials
      • Introduction | Web Application Security Essentials | Cycubix Docs
      • WebGoat | Web Application Security Essentials | Cycubix Docs
        • WebGoat Installation | Web Application Security | Cycubix Docs
          • Stand-alone
          • Docker
        • WebGoat & WebWolf Run | Web Application Security | Cycubix Docs
        • WebGoat Configuration | Web Application Security | Cycubix Docs
        • WebWolf | Web Application Security | Cycubix Docs
          • Webwolf Upload | WebWolf | Web Application Security | Cycubix
          • Webwolf Mail | WebWolf | Web Application Security | Cycubix
          • WebWolf Landing Page | Web Application Security | Cycubix Docs
        • WebGoat & WebWolf System Requirements | Cycubix Docs
      • ZAP | Web Application Security Essentials | Cycubix Docs
        • ZAP | Download & Installation | Cycubix Docs
        • ZAP | Persist ZAP Session | Cycubix Docs
        • ZAP | ZAP Proxy | Cycubix Docs
      • WebGoat Labs | Web Application Security Essentials | Cycubix Docs
        • General | HTTP Basics | Cycubix Docs
          • General | HTTP Basics (1) | Cycubix Docs
          • General | HTTP Basics (2) | Cycubix Docs
          • General | HTTP Basics (3) | Cycubix Docs
        • General | HTTP Proxies | Cycubix Docs
          • General | HTTP Proxies (1) | Cycubix Docs
          • General | HTTP Proxies (2) | Cycubix Docs
          • General | HTTP Proxies (3) | Cycubix Docs
          • General | HTTP Proxies (4) | Cycubix Docs
          • General | HTTP Proxies (5) | Cycubix Docs
          • General | HTTP Proxies (6) | Cycubix Docs
          • General | HTTP Proxies (7) | Cycubix Docs
          • General | HTTP Proxies (8) | Cycubix Docs
          • General | HTTP Proxies (9) | Cycubix Docs
        • General | Developer Tools | Cycubix Docs
          • General | Developer Tools (1) | Cycubix Docs
          • General | Developer Tools (2) | Cycubix Docs
          • General | Developer Tools (3) | Cycubix Docs
          • General | Developer Tools (4) | Cycubix Docs
          • General | Developer Tools (5) | Cycubix Docs
          • General | Developer Tools (6) | Cycubix Docs
        • General | The CIA Triad | Cycubix Docs
          • General | The CIA Triad (1) | Cycubix Docs
          • General | The CIA Triad (2) | Cycubix Docs
          • General | The CIA Triad (3) | Cycubix Docs
          • General | The CIA Triad (4) | Cycubix Docs
          • General | The CIA Triad (5) | Cycubix Docs
        • A1:2021 | Broken Access Control | Cycubix Docs
          • A1:2021 | Hijack a Session | Cycubix Docs
            • A1:2021 | Hijack a Session (1) | Cycubix Docs
            • A1:2021 | Hijack a Session (2) | Cycubix Docs
          • A1:2021 | Insecure Direct Object Reference | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (1) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (2) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (3) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (4) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (5) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (6) | Cycubix Docs
          • A1:2021 | Missing Function Level Access Control | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (1) | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (2) | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (3) | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (4) | Cycubix Docs
          • A1:2021 | Spoofing an Authentication Cookie | Cycubix Docs
            • A1:2021 | Spoofing an Authentication Cookie (1) | Cycubix Docs
            • A1:2021 | Spoofing an Authentication Cookie (2) | Cycubix Docs
        • A2:2021 | Cryptographic Failures | Cycubix Docs
          • A2:2021 | Crypto Basics (1) | Cycubix Docs
          • A2:2021 | Crypto Basics (2) | Cycubix Docs
          • A2:2021 | Crypto Basics (3) | Cycubix Docs
          • A2:2021 | Crypto Basics (4) | Cycubics Docs
          • A2:2021 | Crypto Basics (5) | Cycubix Docs
          • A2:2021 | Crypto Basics (6) | Cycubix Docs
          • A2:2021 | Crypto Basics (7) | Cycubix Docs
          • A2:2021 | Crypto Basics (8) | Cycubix Docs
          • A2:2021 | Crypto Basics (9) | Cycubix Docs
        • A3:2021 | Injection | Cycubix Docs
          • A3:2021 | SQL Injection Intro | Cycubix Docs
            • A3:2021 | SQL Injection Intro (1) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (2) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (3) | Cycubix Docs
            • A3:2021 | SQL injection Intro (4) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (5) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (6) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (7) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (8) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (9) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (10) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (11) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (12) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (13) | Cycubix Docs
          • A3:2021 | SQL Injection Advanced | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (1) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (2) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (3) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (4) | Cycubix Docs
            • A3:2021 |SQL Injection Advanced (5) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (6)| Cycubix Docs
          • A3:2021 | Injection | SQL Injection Mitigation | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (1) | Cycubics Docs
            • A3:2021 | SQL Injection Mitigation (2) |
            • A3:2021 | SQL Injection Mitigation (3) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (4) | Cycubix Docs
            • A3:2021 | SQL injection Mitigation (5) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (6) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (7) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (8) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (9) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (10) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (11) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (12) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (13) | Cycubix Docs
          • A3:2021 | Cross-Site Scripting (XSS) | Cycubix Docs
            • A3:2021 | Cross Site Scripting XXS (1) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (2) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (3) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (4) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (5) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (6) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (7) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (8) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (9) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (10) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (11) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (12) | Cycubix Docs
          • A3:2021 | Cross Site Scripting Stored | Cycubix Docs
            • A3:2021 | Cross Site Scripting Stored (1) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Stored (2)
            • A3:2021 | Cross Site Scripting Stored (3) | Cycubix Docs
          • A3:2021 | Cross Site Scripting Mitigation | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (1) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (2) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (3) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (4) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (5) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (6) |
          • A3:2021 | Path Transversal | Cycubix Docs
            • A3: 2021 | Path Transversal (1) | Cycubix Docs
            • A3:2021 | Path Transversal (2) | Cycubix Docs
            • A3:2021 | Path Transversal (3) | Cycubix Docs
            • A3:2021 | Path Transversal (4) | Cycubix Docs
            • A3:2021 | Path Transversal (5) | Cycubix Docs
            • A3:2023 | Path Transversal (6) | Cycubix Docs
            • A3:2021 | Path Transversal (7) | Cycubix Docs
            • A3:2021 | Path Transversal (8) | Cycubix Docs
        • A5:2021 | Security Misconfiguration | Cycubix Docs
          • A5:2021 | Security Misconfiguration (1) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (2) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (3) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (4) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (5) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (6) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (7) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (8) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (9) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (10) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (11) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (12) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (13) | Cycubix Docs
        • A6:2021 | Vulnerable and Outdated Components | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (1) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (2) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (3) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (4) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (5) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (6) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (7) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (8) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (9) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (10) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (11) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (12) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (13) | Cycubix Docs
        • A7:2021 | Identity and Authentication Failure | Cycubix Docs
          • A7:2021 | Authentication Bypasses | Cycubix Docs
            • A7:2021 | Authentication Bypasses (1) | Cycubix Docs
            • A7:2021 | Authentication Bypasses (2) | Cycubix Docs
          • A7:2021 | Insecure Login | Cycubix Docs
            • A7:2021 | Insecure Login (1) | Cycubix Docs
            • A7:2021 | Insecure Login (2) | Cycubix Docs
          • A7: 2021 | JWT Tokens | Cycubix Docs
            • A7: 2021 | JWT Tokens (1) | Cycubix Docs
            • A7: 2021 | JWT Tokens (2) | Cycubix Docs
            • A7: 2021 | JWT Tokens (3) | Cycubix Docs
            • A7: 2021 | JWT Tokens (4) | Cycubix Docs
            • A7: 2021 | JWT Tokens (5) | Cycubix Docs
            • A7: 2021 | JWT Tokens (6) | Cycubix Docs
            • A7: 2021 | JWT Tokens (7) | Cycubix Docs
            • A7: 2021 | JWT Tokens (8) | Cycubix Docs
            • A7: 2021 | JWT Tokens (9) | Cycubix Docs
            • A7: 2021 | JWT Tokens (10) | Cycubix Docs
            • A7: 2021 | JWT Tokens (11) | Cycubix Docs
            • A7: 2021 | JWT Tokens (12) | Cycubix Docs
            • A7: 2021 | JWT Tokens (13) | Cycubix Docs
            • A7: 2021 | JWT Tokens (14) | Cycubix Docs
            • A7: 2021 | JWT Tokens (15) | Cycubix Docs
            • A7: 2021 | JWT Tokens (16) | Cycubix Docs
            • A7: 2021 | JWT Tokens (17) | Cycubix Docs
            • A7: 2021 | JWT Tokens (18) | Cycubix Docs
            • A7: 2021 | JWT Tokens (19) | Cycubix Docs
          • A7:2021 | Password Reset | Cycubix Docs
            • A7:2021 | Password Reset (1) | Cycubix Docs
            • A7:2021 | Password Reset (2) | Cycubix Docs
            • A7:2021 | Password Reset (3) | Cycubix Docs
            • A7:2021 | Password Reset (4) | Cycubix Docs
            • A7:2021 | Password Reset (5) | Cycubix Docs
            • A7:2021 | Password Reset (6) | Cycubix Docs
            • A7:2021 | Password Reset (7) | Cycubix Docs
          • A7:2021 | Secure Passwords | Cycubix Docs
            • A7:2021 | Secure Passwords (1) | Cycubix Docs
            • A7:2021 | Secure Passwords (2) | Cycubix Docs
            • A7:2021 | Secure Passwords (3) | Cycubix Docs
            • A7:2021 | Secure Passwords (4) | Cycubix Docs
            • A7:2021 | Secure Passwords (5) | Cycubix Docs
            • A7:2021 | Secure Passwords (6) | Cycubix Docs
        • A8:2021 | Software and Data Integrity | Cycubix Docs
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (1) | Cycubix Docs
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (2) | Cycubix Doc
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (3) | Cycubix Doc
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (4) | Cycubix Doc
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (5) | Cycubix Doc
        • A9:2021 | Security Logging Failures | Cycubix Docs
          • A9:2021 | Logging Security (1) | Cycubix Docs
          • A9:2021 | Logging Security (2) | Cycubix Docs
          • A9:2021 | Logging Security (3) | Cycubix Docs
          • A9:2021 | Logging Security (4) | Cycubix Docs
          • A9:2021 | Logging Security (5) | Cycubix Docs
        • A10: 2021 | Server Side Request Forgery | Cycubix Docs
          • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (1) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (2) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (3) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (4) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (5) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (6) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (7) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (8) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (9) | Cycubix Docs
          • A10:2021 | Client Side Request Forgery | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (1) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (2) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (3) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (4) | Cycubix Docs
        • Client Side | Cycubix Docs
          • Client Side | Bypass Front End Restrictions | Cycubix Docs
            • Client Side | Bypass Front End Restrictions (1) | Cycubix Docs
            • Client Side | Bypass Front End Restrictions (2) | Cycubix Docs
            • Client Side | Bypass Front End Restrictions (3) | Cycubix Docs
          • Client Side Filtering | Cycubix Docs
            • Client Side | Client Side Filtering (1) | Cycubix Docs
            • Client Side | Client Side Filtering (2) | Cycubix Docs
            • Client Side | Client Side Filtering (3) | Cycubix Docs
          • Client Side | HTML Tampering | Cycubix Docs
            • Client Side | HTML Tampering (1) | Cycubix Docs
            • Client Side | HTML Tampering (2) | Cycubix Docs
            • Client Side | HTML Tampering (3) | Cycubix Docs
        • Challenges | Cycubix Docs
          • Challenges | Admin Lost Password | Cycubix Docs
          • Challenges | Without password | Cycubix Docs
          • Challenges | Admin Password Reset | Cycubix Docs
          • Challenges | Without Account | Cycubox Docs
  • ISC2 Courses
    • CCSP
      • CCSP Domains
      • CCSP Resource Materials
        • CCSP Mind Map | Cycubix Docs
        • CCSP Official Study Guide
        • CCSP Official Practice Tests
        • CCSP Online Test Bank
    • CISSP
      • CISSP Domains
        • Domain 1: Security and Risk Management
        • Domain 2: Asset Security
          • Link Encryption vs End-to-End Encryption
        • Domain 3: Security Architecture and Engineering
        • Domain 4: Communication and Network Security
        • Domain 5: Identity and Access Management (IAM)
        • Domain 6: Security Assessment and Testing
        • Domain 7: Security Operations
        • Domain 8: Software Development Security
      • CISSP Resource Materials
        • CISSP Official Flashcards
        • CISSP Mind Map | Cycubix Docs
        • CISSP Exam Outline
        • CISSP Official Study Guide
        • CISSP Official Practice Tests
        • CISSP Online Test Bank
        • CISSP Glossary
    • CSSLP
      • CSSLP Resource Materials
        • ISC2 CSSLP Official Flashcards
        • CSSLP Mind Map | Cycubix Docs
        • CSSLP Exam Outline | Cycubix Docs
    • Lexicon
      • A
      • B
  • AWS Courses
    • AWS Certified Security – Specialty (SCS-C02)
  • Crowdstrike
    • Troubleshooting Mac Devices
      • Mac sensors on macOS Ventura may fail to remove Falcon.app when uninstalling
      • System Extensions not activated
  • Jamf
    • Jamf Protect
Powered by GitBook
On this page

Was this helpful?

  1. Application Security Series
  2. Web Application Security Essentials
  3. WebGoat Labs | Web Application Security Essentials | Cycubix Docs
  4. A7:2021 | Identity and Authentication Failure | Cycubix Docs
  5. A7: 2021 | JWT Tokens | Cycubix Docs

A7: 2021 | JWT Tokens (12) | Cycubix Docs

Refreshing a token

Introduction

In this section we touch upon refreshing an access token.

Types of tokens

In general there are two types of tokens: an access token and a refresh token. The access token is used for making API calls towards the server. Access tokens have a limited life span, that’s where the refresh token comes in. Once the access token is no longer valid a request can be made towards the server to get a new access token by presenting the refresh token. The refresh token can expire but their life span is much longer. This solves the problem of a user having to authenticate again with their credentials. Whether you should use a refresh token and an access token depends, below can find a couple of points to keep in mind while choosing which tokens to use.

So a normal flow can look like:

curl -X POST -H -d 'username=webgoat&password=webgoat' localhost:8080/WebGoat/login

The server returns:

{
    "token_type":"bearer",
    "access_token":"XXXX.YYYY.ZZZZ",
    "expires_in":10,
    "refresh_token":"4a9a0b1eac1a34201b3c5659944e8b7"
}

As you can see the refresh token is a random string which the server can keep track of (in memory or store in a database) in order to match the refresh token to the user the refresh token was granted to. So in this case whenever the access token is still valid we can speak of a "stateless" session, there is no burden on the server side to setup the user session, the token is self contained. When the access token is no longer valid the server needs to query for the stored refresh token to make sure the token is not blocked in any way.

Whenever the attacker gets a hold on an access token it is only valid for a certain amount of time (say 10 minutes). The attacker then needs the refresh token to get a new access token. That is why the refresh token needs better protection. It is also possible to make the refresh token stateless but this means it will become more difficult to see if the user revoked the tokens. After the server made all the validations it must return a new refresh token and a new access token to the client. The client can use the new access token to make the API call.

What should you check for?

Need for refresh tokens

Does it make sense to use a refresh token in a modern single page application (SPA)? As we have seen in the section about storing tokens there are two options: web storage or a cookie which mean a refresh token is right beside an access token, so if the access token is leaked chances are the refresh token will also be compromised. Most of the time there is a difference of course. The access token is sent when you make an API call, the refresh token is only sent when a new access token should be obtained, which in most cases is a different endpoint. If you end up on the same server you can choose to only use the access token.

As stated above using an access token and a separate refresh token gives some leverage for the server not to check the access token over and over. Only perform the check when the user needs a new access token. It is certainly possible to only use an access token. At the server you store the exact same information you would store for a refresh token, see previous paragraph. This way you need to check the token each time but this might be suitable depending on the application. In the case the refresh tokens are stored for validation it is important to protect these tokens as well (at least use a hash function to store them in your database).

JWT a good idea?

There are a lot of resources available which question the usecase for using JWT token for client to server authentication with regards to cookies. The best place to use a JWT token is between server to server communication. In a normal web application you are better of using plain old cookies. See for more information:

Links provided by WebGoat are not under HTTPS support.

PreviousA7: 2021 | JWT Tokens (11) | Cycubix DocsNextA7: 2021 | JWT Tokens (13) | Cycubix Docs

Last updated 11 months ago

Was this helpful?

Regardless of the chosen solution you should store enough information on the server side to validate whether the user is still trusted. You can think of many things, like store the ip address, keep track of how many times the refresh token is used (using the refresh token multiple times in the valid time window of the access token might indicate strange behavior, you can revoke all the tokens and let the user authenticate again). Also keep track of which access token belonged to which refresh token otherwise an attacker might be able to get a new access token for a different user with the refresh token of the attacker (see for a nice write up about how this attack works) Also a good thing to check for is the ip address or geolocation of the user. If you need to give out a new token check whether the location is still the same if not revoke all the tokens and let the user authenticate again.

(link does not have HTTPS support)

https://emtunc.org/blog/11/2017/jwt-refresh-token-manipulation/
stop-using-jwt-for-sessions
stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work
flowchart