Google OAuth2 Refresh Token Without Client

Description

General

• Documentation: https://developers.google.com/identity/protocols/oauth2
• Summary: A Google OAuth2 refresh token is issued to an application after a user authorizes it to access their Google account. With the application's client ID (and usually its client secret), the refresh token gets new access tokens for that user's account, without the user being present. It grants the scopes the user authorized, such as Google Cloud, Drive or Gmail access.

This detector finds refresh tokens without their client ID nearby. Some applications, such as command-line tools, publish their OAuth client ID and secret in their source code, so this pair is public. If the token was issued to one of these applications, anyone can use it with the public client ID and secret to get new access tokens for the user's account.

The token is checked against the public OAuth clients of gcloud, the Firebase CLI, the Gemini CLI and rclone. A token issued to another client cannot be checked.

Refresh tokens found with their client ID and secret are covered by the Google OAuth2 Refresh Token detector.

Details for Google OAuth2 Refresh Token Without Client

• Family: token

• Category: cloud_provider

• Company: Google

• High recall: False

• Validity check available: True

• Analyzer available: False

• Revoker available: True

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: 7.1

• Prefixed: False

Revoker

Auth Credentials

Valid credentials needed to authenticate the request. No extra credentials needed for this revoker.

HTTP Calls

List of calls performed by the revoker.

• POST: /revoke

Revocation Mode

Revocation is synchronous.