Will the refresh tokens issue new access token if a compromised access token is sent to the server?

Question

I have been reading about the concepts of access tokens and refresh tokens. I get the part of why refresh tokens might be useful to prevent re-logins and issuing short-lived access tokens to reduce the attack vector.

Consider the scenario where, If I log in, the backend server creates the access token and refresh token. The refresh token is kept with the server but the access token is with the client. Let's say in a cookie, and if the access token is stolen from the cookie and sent to the backend server that has the refresh token, will it issue a new token?

Can someone please help me understand why this is not a problem?

Answer 1

When an expired access token is produced to your Authorization Server, it will just not authenticate the request. It does not generate a refresh token.

When an access token expires, you use the refresh token to generate a new access token. Access tokens are short-lived, so they can be ferried around in slightly unsecure environment. Your refresh tokens are guarded in a safe environment and will not (need not) be ferried around like the access token.

Edit: You don't need an access token to get a new access token. All you need if a refresh token.

In Summary:

1. If you present your Authorization Server (AS) with an access token that is expired, your AS will say that the token is invalid.
2. If your access token expired and you want a new access token, you send only the refresh token to the AS and the AS will give you a new access token.
3. You do not need an (valid / expired) access token to generate a new access token. All you need is a refresh token.
4. A Refresh Token is kept in a secure environment, so it should not get compromised.
5. If an access token gets compromised, it can only be used until its validity. The attacker can not generate a new access token with the old access token.

Answer 2

No, you should not get a new access token / refresh token unless you have a valid refresh token.

So with an access token alone, you will keep access but eventually lose it.