The refresh mechanism is precisely built to avoid saving credentials. Credentials give you access to the whole account, whereas the
refresh token only gives you access to
auth tokens that will work for the designated domain.
You say you app is stateless, but if you can save credentials why can't you save a refresh token?
Besides, your app should handle expiration of the credentials as much as it should handle the expiration of the refresh token. Here are a few ways for credentials to expire:
- User changed password
- User lost right to run the app
- Account was suspended
- User changed username
So here is the basic design you should follow:
- Try communicate with your resource API using your
1. failed, try acquire an
auth token with your
2. failed, show login view to acquire a new
I suspect you are using
OAuth. Respect the design pattern you're following, doing anything out of the pattern will put you at risks.
You could also offer your users the possibility to revoke a session (
refresh token). That way, they can log out a compromised device without having to change their password. If you save the password, the only way to remotely log out a device is to change the password, hence logging out all you devices.