Scope narrowing limits during refresh token rotation
0 reputation · 12 Nov 2023, 10:58 UTC
OAuth 2.0 utilizes scopes to enforce least-privilege access, restricting a client to specific data subsets. While the Refresh Token grant type allows clients to obtain new access tokens without re-authentication, the behavior regarding scope reduction during this process remains inconsistent across authorization servers.
When a client uses Refresh Token Rotation, a new refresh token is issued with each request. However, it is unclear whether a client can successfully request a new access token with a subset of the original scopes during the refresh. If the server does not support scope narrowing, it may either reject the request or return a token with the original broad set.
Does standard OAuth 2.0 behavior allow a refresh token to request fewer scopes than the initial grant? If scope narrowing is denied, what is the standard error response for a client attempting to downgrade privileges during a refresh?