Linked Questions
49 questions linked to/from Why Does OAuth v2 Have Both Access and Refresh Tokens?
8
votes
2
answers
4k
views
What benefits refresh tokens in OAuth2 [duplicate]
Based upon The OAuth 2.0 Protocol Refresh Tokens are used to re-authenticate access token and mainly to maintain revoking by saving refresh tokens into Database and control them. What is the benefit ...
- 5,987
-1
votes
1
answer
120
views
Google OAuth - Difference between ACCESS TOKEN and REFRESH TOKEN [duplicate]
So, I know that access token is being received always when the user logs in and is valid for 1 hour.
And the refresh token is also received, but only when user is prompt to agree with rights.
This ...
- 2,517
327
votes
12
answers
172k
views
What is the purpose of a "Refresh Token"?
I have a program that integrates with the YouTube Live Streaming API. It runs on timers, so its been relatively easy for me to program in to fetch a new Access Token every 50 minutes with a Refresh ...
- 7,935
111
votes
4
answers
58k
views
Is a Refresh Token really necessary when using JWT token authentication?
I'm referencing another SO post that discusses using refresh tokens with JWT.
JWT (JSON Web Token) automatic prolongation of expiration
I have an application with a very common architecture where my ...
- 9,312
121
votes
5
answers
27k
views
What's the point of refresh token?
I have to confess I've had this question for a very long time and never really understood.
Say an auth token is like a key to a safe; when it expires it's not usable anymore. Now we're given a magic ...
- 3,000
52
votes
2
answers
21k
views
What is the difference between id_token and access_token in Auth0
In Auth0 you can use refresh tokens. In this link, we can see many returned parameters:
lock.showSignin({
authParams: {
scope: 'openid offline_access'
}
}, function (err, profile, id_token, ...
- 2,532
31
votes
2
answers
46k
views
Is it secure to store a refresh token in the database? (To issue new access tokens for login purposes). Or is there a method to do it easier?
Currently im trying to gather knowledge on how to implement an auth system (a login) . And during my research i've tried to implement a JWT based solution in my backend.
I have an express server ...
- 1,600
26
votes
7
answers
34k
views
How to secure a refresh token?
I'm using JWTs for authenticating users for my app. When a user logs in they are given an access token and a refresh token. To keep the refresh token safe, I don't store it on the client-side, but ...
- 10.1k
25
votes
3
answers
16k
views
Google Play Developer API - Query purchase token returns Invalid Value
I am trying to set up a web service to query Google Play purchases. We store the order information for customers and this service would call Google Play API to query the subscription details.
Every ...
- 251
19
votes
4
answers
4k
views
Are refresh tokens necessary for online applications
Per Google's docs it would seem refresh tokens are only necessary for offline applications (applications that may run into an expired access token when the user isn't around).
Access tokens ...
- 44.5k
11
votes
3
answers
13k
views
Access token revocation implementation in OAuth 2
I've used OWIN OAuth 2 to implement my Authorization Server Provider. Now, I want to implement token revocation (when my client application wants to logout).
Can anybody help me and tell how to ...
- 1,040
10
votes
1
answer
19k
views
Android refresh token
I'm developing an Android app and I'm a little confused regarding token and refresh token.
Basically now, after user login with mobile number and a code sent by SMS, the authentication server returns ...
- 1,977
17
votes
1
answer
8k
views
How to securely keep my users signed in with refresh tokens?
From https://stackoverflow.com/a/7209263/1225328:
The idea of refresh tokens is that if an access token is compromised,
because it is short-lived, the attacker has a limited window in which
to ...
- 49k
11
votes
1
answer
8k
views
ASP.NET Web Api (REST): Authentication using the users credentials or a token? Leave "Register new user" resource password free?
I am trying to create a REST service using asp.net web api and everything is working fine but I have now come across what to do with authentication.
I am a little confused of where to start, here is ...
- 24.3k
10
votes
1
answer
5k
views
Why use JWT refresh token
I'm not sure I understand the concept of refresh tokens. I know what they do - store them somewhere and whenever the access token expires, get a new access token with them.
It is obviously very ...
- 2,358