3 ms·
The access tokens go everywhere, to all services and are much more likely to be accidentally leaked / misappropriated. Refresh tokens are only used when talking
by growse 3y ago
The access tokens go everywhere, to all services and are much more likely to be accidentally leaked / misappropriated. Refresh tokens are only used when talking (infrequently) to the access token minting service, so the scope of use is much much narrower.
- kaoD 3y agoSo if I get this correctly, this is mostly useful for microservices and would be kinda pointless for a monolithic architecture?
- growse 3y agoNot even necessarily microservers. If you want a common authentication system used by lots of disparate services, token based Auth is a reasonable approach. If you've just got one service endpoint, it doesn't buy you very much. Just mint a session token and be done with it.