4 ms·
Maybe not for Google, but it's not part of the OAuth spec. It's perfectly valid for refresh tokens to expire.
by gerwim 3y ago
Maybe not for Google, but it's not part of the OAuth spec. It's perfectly valid for refresh tokens to expire.
- nunez 3y agoInteresting. Many of the OAuth services I've used use non-expiring refresh tokens. Though I definitely agree; they should also have an expiry.