I have two API's used in auth
:
api/auth/newtoken
: Successfully validates user (i.e. username and password check in DB) and returntoken
(expirers in 3 days) andrefreshToken
.api/auth/updatetoken
: When the token is expired call this API withrefreshToken
and get the newtoken
.
How can I protect the api/auth/updatetoken
API? Currenlty these API's are for an Android application and it will be easy to get these API's once we decomplile the application.
What are some better approaches to secure this API?
updatetoken
? Doesn't it check that therefreshToken
is valid anyway?