offline_access

[danielfett]

Via email:

Hi,

I think there is at least one more important topic to address in the document - the offline_access scope value.

Especially with a SPA application, where the scope attribute value is under web browser control, it can be manipulated. If an attacker can do that and can ask refresh_token without the exp parameter, it means, it never expires (from the JWT point of view).

• https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
• https://www.keycloak.org/docs/latest/server_admin/#_offline-access

regards,
Elar Lang