I'm implementing an oAuth2 authentification to secure my REST Api.
As I am implementing oAuth2, I need to generate an
access_token which will give me a temporary access to my REST datas.
To do it, I simply send an HTTP request with an
id and a
secret, which returns an
access_token and a
refresh_token. That is the first time I am implementing an oAuth2, and I did some research about what
It looks like everybody says that the
refresh_token must be stored securely, because it allows you to regenerate an
access_token. From what I understood, refresh tokens are long-lived, while acces token expires fast, and don't need as much as security as refresh token does, because it expires fast. I am able to use that
refresh_token to get a new
access_token, using the same
id and the same
secret I use to generate my first
My questions are :
- Why do we use refresh tokens if they need to much security, while we could just regenerate an access each time it expires?
- It is really just all about checking faster the identity of the one who is sending the request?
I apologies if I am not asking in the right StackExchange site.