refreshtoken - w/o access token - security

ul0815 — Sat, 18 Sep 2021 16:19:44 GMT

Hello,

I just tried to get started with the API.

I still hang at the auth process and don't understand why I can do this:

curl -X POST "https://iam.viessmann.com/idp/v2/token" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=refresh_token&client_id=<client_id>&refresh_token=<refresh_token>"

When looking up the API of my wallbox: https://api.easee.cloud/index.html

I have to provide the access token AND the refresh token to get a new token and I have to make an authenticated call.

For viessmann, I just need the client id and the former refresh token to get a new access token.

I suggest to improve this and make it more secure, by ALWAYS require the access token AND the Bearer authentication when doing a refresh.

This is much harder to hack, than this simple way.

Regards

Re: refreshtoken - w/o access token - security

CustomerCareMichael — Mon, 27 Sep 2021 11:28:12 GMT

Hi @ul0815 ,

Thank you for your feedback!

Our authentication process is compliant to the OAuth 2.0 authorization framework as well as OpenID Connect (Core) specification. Both define the refresh_token request in a consistent way where the among other parameters only the refresh_token needs to be included in the request. The access_token is not required, see:
https://openid.net/specs/openid-connect-core-1_0.html#RefreshingAccessToken
https://datatracker.ietf.org/doc/html/rfc6749#section-6

Best,

Michael

Thema "refreshtoken - w/o access token - security" in Getting started programming with the Viessmann API

refreshtoken - w/o access token - security

Re: refreshtoken - w/o access token - security