0

We have several endpoints which were authenticated using a bearer access-token. There was another endpoint which will renew/generate a new bearer access-token on passing valid secret_id and client_id.

Now a client is asking for a new endpoint which will give them their already generated bearer access-token as a response from DB on passing valid secret_id and client_id but I feel that it was wrong to have such an endpoint based on several other APIs that I have used in the past.

Are there any drawbacks on providing such an endpoint? Are there any security issues that i should be worried about?

  • I think the main problem is that as long as the access token is valid, whoever has access to that token can perform actions on behalf of another user. – José Amílcar Casimiro Jul 26 '19 at 10:13
  • What purpose would the new endpoint fulfill that the existing token generating endpoint doesn't serve? It would only provide information that the client already has or that he can generate using the existing service if he accidentally lost his token. Since this is in a security-related area of the application, I would not take a mere "we want that feature" as sufficient reason to implement it. Maybe you should ask the client what problem they want to solve that can't be solved using the existing API. – Hans-Martin Mosner Jul 26 '19 at 13:15
0

I think its low risk. The main worry I would have is that maybe they will be calling it all the time instead of keeping their token.

But there are a couple of worries.

  1. Do you now have to keep a db of access tokens? That ia a new attack vector

  2. What about token expiry? do you refresh the expiry date or send an indentical token?

  3. What about refresh tokens? arr they using them or just relogging in all the time?

As with all security questions you are better off using a standard rather than rolling your own. Any custom request comes with the problem of it not being "battle tested".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.