3 ms·
I am no JWT expert, but I have found them useful for APIs rather than web apps accessed from the browser. If the user is expected to use a programming language
by sseagull 3y ago
I am no JWT expert, but I have found them useful for APIs rather than web apps accessed from the browser.
If the user is expected to use a programming language and hit the API many times a second, then even a short expiration and moderate refresh really help (might fully authenticate every 5 mins, which could be thousands of requests for some APIs).
- kaoD 3y agoBut again, what's the difference between that and just having a moderately-long access token if you'll still be handing out access tokens for the lifetime of the refresh token?
- pests 3y ago> for the lifetime of the refresh token Not guaranteed for the lifetime of refresh tokens, which is the case for access tokens. > whats the difference? A 5 min access token is valid for 5 minutes. A 5 minute refresh token can be revoked before its even used.
- sseagull 3y agoAnother comment mentioned it, but: 1. You can check for user changes when the refresh token is used and a new access token is requested (user deleted, permissions changed, access revoked) 2. Refreshes can go to a different endpoint, whereas access tokens could be used with services that don’t even have access to user auth services. Edit: There is something to be said for ditching the refresh token and just re-authenticating when the access token expires. The benefit is that you don’t need to store the username/password in the client code to re-auth, and you might avoid some relatively expensive password checking on the server, but that is probably pretty minor.
- deleted 3y ago[deleted]