Refresh Token
A special type of token used to obtain a new access token when the current one expires.
Detailed Explanation
Access tokens are typically short-lived (e.g., 1 hour) for security. When it expires, the client uses a long-lived 'Refresh Token' to get a new one without forcing the user to log in again. This allows for a good balance between security (short-lived access) and user experience (not needing to re-authenticate daily).
Quick Summary
Refresh tokens let clients get new short-lived access tokens without re-prompting the user. They make "short access + long session" possible, but they're high-value credentials that need careful handling.
Key Takeaways
- Access tokens are minutes to an hour; refresh tokens are days to months.
- Stored more securely than access tokens, httpOnly cookies, secure storage, or backend-managed sessions.
- Use refresh token rotation: each use issues a new refresh token and invalidates the old one. Stolen tokens get caught by reuse detection.
- Bind refresh tokens to client and device fingerprints when possible.
- Revocation must be supported and tested, a leaked refresh token is a long-lived backdoor otherwise.
When to use it
- OAuth 2.0 flows where access tokens are intentionally short.
- Mobile apps that need to remain signed in for weeks without re-prompting.
- SPAs using the Authorization Code + PKCE flow with backend-for-frontend storing refresh tokens.
- Microservice clients that need to refresh credentials without human interaction.
Common Mistakes
- Storing refresh tokens in localStorage, XSS-accessible and effectively gives away a long-lived credential.
- No rotation, a stolen refresh token works until it expires (could be months).
- Treating refresh tokens like access tokens (sending them on every request), they should be used only at the token endpoint.
- Missing the "reuse of an old refresh token" alert, which is the canary for theft.
Refresh Token, Frequently Asked
Where should I store refresh tokens in a web app?
HttpOnly, Secure, SameSite cookies on a backend-for-frontend, or server-side session storage keyed by a cookie. Never in localStorage or non-httpOnly cookies, XSS will grab them.
What's refresh token rotation?
Each time the client uses a refresh token, the server issues a new one and invalidates the previous. If the old one is ever used again, it's evidence of theft, and the server revokes the whole token family. This turns long-lived credentials into one-shot tokens.