4 ms·
"Session" here is the word used for the duration in which an access token is valid. You may be talking about UX, but the submission is talking about access tok
by Zetice 3y ago
"Session" here is the word used for the duration in which an access token is valid. You may be talking about UX, but the submission is talking about access tokens.
- kyle-rb 3y agoThe article specifically mentions the need for users to re-enter their username and password as a downside of short-lived sessions, so I think the author's definition of "session" extends as long as the refresh token lasts. I think that most of the non-short-session examples — Google, Microsoft, GitHub, etc — are using an access token + refresh token pattern.
- Zetice 3y agoThat's because it's a poorly written article by someone who doesn't know the difference. It interchangeably talks about issues only with the UX and the actual technical backend pieces involved.
- dwaite 3y agoThe length of time an access token is a delegated authorization, not an authentication session. For first party mobile apps and the like, they might act similarly, but for other use cases they will not. The access token may be so my account at an event coordination site has free/busy access to my Google calendar, and that authorization might last for years.