Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Say I have a refresh token that is set to expire in 14 days. And I have an access token that expires in 20 minutes.
What if every time you update the access token (using the refresh token), the server hands you back a newer refresh token with an expiration 14 days from when you updated the access token?
Is this a bad idea? Why or why not?
It depends on what sort of system you want to create.
Requiring a re-up of the refresh token is annoying, as users have to enter their password again (or whatever the process is). If this is an automated process, like an application that runs unattended on a server, this becomes not just a UX issue but a stability one as well, as the system will break if someone doesn't remember to log in and manually get a new refresh token.
However, there's a reason you see this sort of setup. For instance, Google logs you out of all their webapps every month, which prevents someone who has access to your account (stolen laptop, left yourself logged-in at a library, etc.) from maintaining that access indefinitely.
