The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Why it exists
Access tokens, like JWTs, should be short-lived to minimize the damage if they are stolen. But forcing users to log in every 15 minutes creates a terrible user experience. The refresh token pattern solves this by letting an application get a new access token without user interaction.
The mental model
Think of an access token as a single-day pass to an amusement park, and a refresh token as your season pass ID card. You show the day pass to get on rides. When it expires, you don't buy a new season pass; you just show your ID card at the office to get a new day pass. The ID card (refresh token) is long-lived and valuable, while the day pass (access token) is short-lived and disposable.
How it works
During initial login, the authentication server gives the client both a short-lived access token and a long-lived refresh token. The client uses the access token to call protected APIs. When the access token expires, the client sends the refresh token to a special endpoint on the auth server. If the refresh token is valid, the server issues a new access token. This process happens without the user needing to enter their password again.
When to use it
Use this pattern in any application where you want to maintain a user session beyond the short lifespan of a single access token. It is critical for mobile apps, where users expect to stay logged in for weeks, and for Single-Page Applications (SPAs), where it provides a reliable session mechanism that isn't affected by browser privacy features blocking third-party cookies.
When not to use it
Avoid this pattern if your security model requires explicit user re-authentication for every session or for highly sensitive operations. If your application doesn't need to maintain a session after the user closes the browser (e.g., a simple informational website), the added complexity might be unnecessary.
One canonical example
A user logs into a mobile banking app. The app receives an access token (valid for 10 minutes) and a refresh token (valid for 30 days). The user checks their balance. Two hours later, they re-open the app. The app sees the access token is expired. It silently uses the refresh token to get a new 10-minute access token. The user is seamlessly logged in without re-entering their password. For added security, Refresh Token Rotation can be used, where obtaining a new access token also invalidates the old refresh token and issues a new one.
Interview question
What is the primary benefit of using a refresh token in conjunction with short-lived access tokens?
- a.It enables applications to acquire new access tokens without user re-authentication, balancing security with a seamless user experience.Correct
- b.It allows for the secure storage of user credentials directly on the client device.
- c.It extends the validity period of access tokens, making them long-lived for convenience.
- d.It provides an immediate notification system for users when their access token is about to expire.
Why? this is the answer
The refresh token pattern allows applications to obtain new, short-lived access tokens without requiring the user to log in again, thereby improving user experience while maintaining security. Access tokens remain short-lived to minimize the impact of theft, which contradicts the idea of extending their validity.
Just read this? Test yourself on what you have been reading.
Read the original → auth0.com
- #authentication
- #security
- #oauth
- #jwt
- #api
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on authentication — each one lists the topics its interview covers.
See open roles