{"action":"created","issue":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1256","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1256/labels{/name}","comments_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1256/comments","events_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1256/events","html_url":"https://github.com/jhipster/generator-jhipster/issues/1256","id":61301288,"number":1256,"title":"Disabling Oauth2 refresh token ","user":{"login":"aklauza","id":11398584,"avatar_url":"https://avatars.githubusercontent.com/u/11398584?v=3","gravatar_id":"","url":"https://api.github.com/users/aklauza","html_url":"https://github.com/aklauza","followers_url":"https://api.github.com/users/aklauza/followers","following_url":"https://api.github.com/users/aklauza/following{/other_user}","gists_url":"https://api.github.com/users/aklauza/gists{/gist_id}","starred_url":"https://api.github.com/users/aklauza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aklauza/subscriptions","organizations_url":"https://api.github.com/users/aklauza/orgs","repos_url":"https://api.github.com/users/aklauza/repos","events_url":"https://api.github.com/users/aklauza/events{/privacy}","received_events_url":"https://api.github.com/users/aklauza/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-13T23:58:17Z","updated_at":"2015-04-15T16:08:19Z","closed_at":"2015-04-15T16:08:19Z","body":"As I can infer from these two closed issues (https://github.com/jhipster/generator-jhipster/issues/441 and https://github.com/jhipster/generator-jhipster/issues/1170) and the code, jHipster is not implementing the refresh token flow in the Oauth2 protocol.\r\n\r\nThis is completely fine and optional, and some big providers are not implementing it either (github for example). However, if you guys decided not to implement it for now (which I completely agree as will show later in the post), you should disable it completely in Spring. As it is now, the AuthorizationServer keeps sending the refresh_token and its endpoint is still open. To change this, in OAuth2ServerConfiguration.configure() method you should change this line:\r\n```java\r\n.authorizedGrantTypes(\"password\")\r\n```\r\nand add the following:\r\n```java\r\n.refreshTokenValiditySeconds(0)\r\n```\r\nNow the refresh_token will not be provided by the server and therefore, the oauthTokens are really short lived and the user has to login again when they expire, which is more secure. Security is the reason why some providers are deciding not to implement the refresh_token flow in the protocol.\r\n\r\nIf you keep open the refresh_token endpoint on the server, anyone with access to the user's browser localStorage could be requesting valid tokens from the server for months, and therefore use the client's credentials without even knowing the username or password. The refresh_token is really a weakness in the Oauth2 protocol. I strongly recommend you to disable it. On the other side, in the your docs, you should clearly state that Oauth2 protocol MUST be implemented in conjunction with HTTPS. Without a secure connection it is highly vulnerable."},"comment":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/comments/93465390","html_url":"https://github.com/jhipster/generator-jhipster/issues/1256#issuecomment-93465390","issue_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1256","id":93465390,"user":{"login":"jdubois","id":316835,"avatar_url":"https://avatars.githubusercontent.com/u/316835?v=3","gravatar_id":"","url":"https://api.github.com/users/jdubois","html_url":"https://github.com/jdubois","followers_url":"https://api.github.com/users/jdubois/followers","following_url":"https://api.github.com/users/jdubois/following{/other_user}","gists_url":"https://api.github.com/users/jdubois/gists{/gist_id}","starred_url":"https://api.github.com/users/jdubois/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdubois/subscriptions","organizations_url":"https://api.github.com/users/jdubois/orgs","repos_url":"https://api.github.com/users/jdubois/repos","events_url":"https://api.github.com/users/jdubois/events{/privacy}","received_events_url":"https://api.github.com/users/jdubois/received_events","type":"User","site_admin":false},"created_at":"2015-04-15T16:08:19Z","updated_at":"2015-04-15T16:08:19Z","body":"For me this is the same discussion as #1257 so I'm closing this, and let's discuss this in the other ticket"}}