3 ms·
The article specifically mentions the need for users to re-enter their username and password as a downside of short-lived sessions, so I think the author's defi
by kyle-rb 3y ago
The article specifically mentions the need for users to re-enter their username and password as a downside of short-lived sessions, so I think the author's definition of "session" extends as long as the refresh token lasts.
I think that most of the non-short-session examples — Google, Microsoft, GitHub, etc — are using an access token + refresh token pattern.
- Zetice 3y agoThat's because it's a poorly written article by someone who doesn't know the difference. It interchangeably talks about issues only with the UX and the actual technical backend pieces involved.