I want to use API in my .net WinForms application which are closed by JWT token. Such tokens can be received from the Identity Provider using Authorization Code Flow + PKCE. I worked with such flow before in Web Application and I know how to request code, exchange it on the access token and I used silent refresh approach to refresh the access tokens. For my clientId I'm not able to use refresh tokens. So, I'm slightly confused how to implement to refresh tokens in the Winforms application. It's definitely I need to open Login page to allow the customer enter credentials. Then I guess I need to catch code from the Redirect URL. It seems I need to use loopback IP address as a redirect URL and catch request in the application. But how to set up refreshing process I have no idea. Please help with advice or add links to examples.
Refresh token in Desktop App for OAuth2 Authorization Code Flow
300 views Asked by SlavaHq At
1
There are 1 answers
Related Questions in WINFORMS
- Add additional fields to Linq group by
- couldn't copy pdb file to another directory while consuming wcf web service
- Why are the aliases for string and object in lowercase?
- WPF MessageBox Cancel checkbox check
- Resolve object using DI container with object instance
- Creating a parametrized field name for a SELECT clause
- Does compiler optimize operation on const variable and literal const number?
- Get data from one form to another form in C#
- Writing/Overwriting to specific XML file from ASP.NET code behind
- Deleting Orphans with Fluent NHibernate
Related Questions in OAUTH-2.0
- Add additional fields to Linq group by
- couldn't copy pdb file to another directory while consuming wcf web service
- Why are the aliases for string and object in lowercase?
- WPF MessageBox Cancel checkbox check
- Resolve object using DI container with object instance
- Creating a parametrized field name for a SELECT clause
- Does compiler optimize operation on const variable and literal const number?
- Get data from one form to another form in C#
- Writing/Overwriting to specific XML file from ASP.NET code behind
- Deleting Orphans with Fluent NHibernate
Related Questions in JWT
- Add additional fields to Linq group by
- couldn't copy pdb file to another directory while consuming wcf web service
- Why are the aliases for string and object in lowercase?
- WPF MessageBox Cancel checkbox check
- Resolve object using DI container with object instance
- Creating a parametrized field name for a SELECT clause
- Does compiler optimize operation on const variable and literal const number?
- Get data from one form to another form in C#
- Writing/Overwriting to specific XML file from ASP.NET code behind
- Deleting Orphans with Fluent NHibernate
Related Questions in OAUTH-REFRESH-TOKEN
- Add additional fields to Linq group by
- couldn't copy pdb file to another directory while consuming wcf web service
- Why are the aliases for string and object in lowercase?
- WPF MessageBox Cancel checkbox check
- Resolve object using DI container with object instance
- Creating a parametrized field name for a SELECT clause
- Does compiler optimize operation on const variable and literal const number?
- Get data from one form to another form in C#
- Writing/Overwriting to specific XML file from ASP.NET code behind
- Deleting Orphans with Fluent NHibernate
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Popular Tags
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
For a desktop app you should follow the recommendations from RFC8252. Without a token refresh you will get usability problems. Eg access token expires after 15 or 30 minutes, then user experiences a re-opening of the system browser.
This might be fine for a high security app, such as for banking, but for most apps it is not what you want. Alternatives such as long lived access tokens are bad from a security viewpoint, since the long lived value is then exposed on every API request.
You won't be able to use silent renew via hidden iframes either, since you don't have that much control over the system browser. You can only open it by executing a URL.
So you have these main choices, and maybe you can explain trade offs to stakeholders. You won't be able to implement a workaround in code:
Locking down what can be done with an access token issued to the desktop app - using scopes and claims - is usually the main mitigation of this type of security concern.