🎄 Join our Annual Holiday wargame and win prizes!


Infinite Token

Infinite Token (or Token Cycling) vulnerability occurs when a refresh token is designed in a way that it never expires or can continuously issue new refresh tokens. This allows for indefinite authentication sessions, even in cases where a token is compromised.

Remediation

  • Always enforce a finite lifetime for refresh tokens, ensuring they expire after a reasonable period.
  • Implement a rotation mechanism where each refresh token is single-use and a new one is issued upon successful usage. Revoke the old token upon rotation.
  • Use sliding expiration for refresh tokens, where the lifetime is extended only when valid tokens are used near expiration. Avoid indefinite extensions.
  • * Ensure that logging out invalidates all active tokens, both access and refresh, across devices.
  • Require users to re-authenticate periodically or for high-risk actions, reducing reliance on long-lived tokens.

Metadata

  • Severity: medium
  • Slug: infinite-token

CWEs

  • 613: Insufficient Session Expiration

OWASP

  • A07:2021: Identification and Authentication Failures

Available Labs

Select a language to explore available labs for this vulnerability.

No matching labs found

Try adjusting your language filter.

Deco line
Deco line

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now
Deco line
Deco line

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.

Read more