{"action":"created","issue":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986","labels_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986/labels{/name}","comments_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986/comments","events_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986/events","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986","id":122943775,"number":986,"title":"Using authorization code for second time should invalidate first access token","user":{"login":"mtommila","id":6064522,"avatar_url":"https://avatars.githubusercontent.com/u/6064522?v=3","gravatar_id":"","url":"https://api.github.com/users/mtommila","html_url":"https://github.com/mtommila","followers_url":"https://api.github.com/users/mtommila/followers","following_url":"https://api.github.com/users/mtommila/following{/other_user}","gists_url":"https://api.github.com/users/mtommila/gists{/gist_id}","starred_url":"https://api.github.com/users/mtommila/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtommila/subscriptions","organizations_url":"https://api.github.com/users/mtommila/orgs","repos_url":"https://api.github.com/users/mtommila/repos","events_url":"https://api.github.com/users/mtommila/events{/privacy}","received_events_url":"https://api.github.com/users/mtommila/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-18T12:53:05Z","updated_at":"2015-12-18T12:56:21Z","closed_at":null,"body":"There was a finding in a security audit:\r\nSecond attempt to resolve authorization code should revoke previously issued access token.\r\nI.e. if an attacker is able to steal an authorization code (this is highly non-trivial of course) and use it to get an access token, then the second attempt to use the authorization code should return an access token, but invalidate the first access token. This way, if the attacker used the authorization code first (before the legitimate client did), the attacker's access token would be invalid. If the attacker used the authorization code after the legitimate client, then the client would notice that the access token is invalid and something is wrong.\r\nThere is also another use case for this functionality. If there is a temporary network problem when the client tries to use the authorization code, the first attempt can fail, but the client could retry using the authorization code. Currently the second call would fail (because the authorization code becomes invalid after the first time it's used). However it could be better if the second call still succeeded but the access token given in the first call would just be invalidated."},"comment":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/comments/165771554","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986#issuecomment-165771554","issue_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/986","id":165771554,"user":{"login":"praseodym","id":20283,"avatar_url":"https://avatars.githubusercontent.com/u/20283?v=3","gravatar_id":"","url":"https://api.github.com/users/praseodym","html_url":"https://github.com/praseodym","followers_url":"https://api.github.com/users/praseodym/followers","following_url":"https://api.github.com/users/praseodym/following{/other_user}","gists_url":"https://api.github.com/users/praseodym/gists{/gist_id}","starred_url":"https://api.github.com/users/praseodym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/praseodym/subscriptions","organizations_url":"https://api.github.com/users/praseodym/orgs","repos_url":"https://api.github.com/users/praseodym/repos","events_url":"https://api.github.com/users/praseodym/events{/privacy}","received_events_url":"https://api.github.com/users/praseodym/received_events","type":"User","site_admin":false},"created_at":"2015-12-18T12:56:20Z","updated_at":"2015-12-18T12:56:20Z","body":"RFC 6749 says:\r\n> The authorization code generated by the authorization server.  The authorization code MUST expire         shortly after it is issued to mitigate the risk of leaks.  A         maximum authorization code lifetime of 10 minutes is         RECOMMENDED.  The client MUST NOT use the authorization code   more than once.  If an authorization code is used more than         once, the authorization server MUST deny the request and SHOULD         revoke (when possible) all tokens previously issued based on         that authorization code.  The authorization code is bound to         the client identifier and redirection URI."}}