The Day Two Security Features Cancelled Out
Part of the Refresh Token Design series. Two Correct Features Branching says a refresh that cannot prove its device gets a new row of its own, copying the device key from the row it came from, opening at the lowest tier. The honest case is a browser whose storage was cleared, and its road back is to prove a second factor, which rebinds the row to a fresh key. Per request signing says every request carrying a session must be signed by the device key on that session’s row. ...