Refresh Token

Is to renew the Access Token in case the access token is expired.

Refresh token can be random ID or JWT

• Normally we use Random ID so that we can store in a database and manually invalidate. Which give us more secure way to control
• Also we can consider Refresh token rotation to keep the token changing

Considering the following flow:

1. Application authorise
2. Server returns access_token and refresh_token
3. Application uses the access_token to authorised
4. Server approved the request
5. access_token expires
6. Application uses the access_token to authorised
7. Server deny the request
8. Application uses the refresh_token to get the new access_token
9. Application uses the access_token to authorise

Refresh token rotation

To avoid exposing the refresh token, we can rotate the refresh token every single time we receive a refresh token. So the flow happen as below:

1. access_token expires
2. Client uses refresh_token to get a new access_token
3. Server invalidate previous refresh_token and return new access_token and refresh_token
   1. To invalidate, you typically have to either store the last refresh_token per user or keep track of their last one and make sure the new one is different than the last one
   2. Or keep track of expired refresh_token to invalidate
4. Client stores the new refresh_token

Why refresh token?

1. To get access token, client need to relogin. We dont want client login every single time
2. Access token if it's leaked out it's dangerous. It's better to do short-live and paired with refresh token

Where to store access & refresh token

Use Cookies