Feature Request: Use Refresh Token

[minimalisticMe]

When authenticating via basic Authentication over OAuth2, the access token and refresh token are returned.
The access token is valid for a "short" period of time.
The current implementation foresees to fetch a new access token with full basic OAuth2-workflow instead of utilizing the refresh token to get a new access token.

Unfortunately I don't know anything about the BMW API.
But there should be a wat to get a new access token via refresh token.

Is there a way to reengineer this?

Edit:
From a security aspect this has the advantage that I don't have to save my credentials on my computer but just enter them once and then use the refresh token for some time.

[gerard33]

@rikroe is the specialist for the authentication.

As we don't use an official API I don't think your method is possible though.

[rikroe]

I've tried using a standardized OAuth library before, but unfortunately didn't succeed.
BMW has implemented some additional obscurity layers to its API, so it is not as easy as compared to e.g. the Github OAuth flow.

I do get your point in regard to storing you username/password credentials. However from what I understand of refresh tokens (not a security engineer here) it would only add security by obscurity.
Refresh tokens are long lived and might not even expire when you change your accounts password (depends what BMW has implemented). They need to be stored at the same security levels than username and password.

We quickly got some other implications coming up such as what are we going to do when a token actually expires? How to get a new one? How to incorporate that on cli?

If I've got some time I might explore some options and basic tests here, but would some additional support in the login topics would be welcome!

[minimalisticMe]

@rikroe That's a good point.
So far I found out that neither Access-, Refresh-, OAuth-Access- nor OAuth-Refresh-Token are standard Web Tokens.
Or maybe they are, but they are encrypted.

Maybe I'll have a deeper look into that.