Invalidate refresh tokens by default for OAuth public clients

[hickford]

Feature Description

Configuration option oauth2.INVALIDATE_REFRESH_TOKENS defaults to false. For public clients, refresh token invalidation should be the default following OAuth security best practice https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-22#name-refresh-tokens

Refresh tokens for public clients MUST be sender-constrained or use refresh token rotation

The configuration option would then apply only to confidential clients.

Screenshots

No response

[hickford]

Relevant code

gitea/routers/web/auth/oauth.go

Lines 149 to 156 in d1e066f

	if setting.OAuth2.InvalidateRefreshTokens {
	if err := grant.IncreaseCounter(ctx); err != nil {
	return nil, &AccessTokenError{
	ErrorCode: AccessTokenErrorCodeInvalidGrant,
	ErrorDescription: "cannot increase the grant counter",
	}
	}
	}

gitea/routers/web/auth/oauth.go

Lines 732 to 739 in d1e066f

	// check if token got already used
	if setting.OAuth2.InvalidateRefreshTokens && (grant.Counter != token.Counter || token.Counter == 0) {
	handleAccessTokenError(ctx, AccessTokenError{
	ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
	ErrorDescription: "token was already used",
	})
	log.Warn("A client tried to use a refresh token for grant_id = %d was used twice!", grant.ID)
	return