> Do you sign a request with that reauth token or do you send the reauth token? Sign > Because if they’re getting mitm then all is lost. This is true regardl

> Do you sign a request with that reauth token or do you send the reauth token? Sign > Because if they’re getting mitm then all is lost. This is true regardless of your authentication scheme, which is why https is important and then you have to hope they didn't just click through a warning and ignore it or have their trust store compromised or.... > How long does the reauth token last for? Until it is reissued. But since the auth token is only good for 12 hours, effectively 12 hours max, since it can't be used for reauth without a valid auth token. > Is a new one issued when you reauth? Yes.