I'm implementing an oAuth2 authentification to secure my REST Api.
As I am implementing oAuth2, I need to generate an access_token
which will give me a temporary access to my REST datas.
To do it, I simply send an HTTP request with an id
and a secret
, which returns an access_token
and a refresh_token
. That is the first time I am implementing an oAuth2, and I did some research about what access_token
and refresh_token
are.
It looks like everybody says that the refresh_token
must be stored securely, because it allows you to regenerate an access_token
. From what I understood, refresh tokens are long-lived, while acces token expires fast, and don't need as much as security as refresh token does, because it expires fast. I am able to use that refresh_token
to get a new access_token
, using the same id
and the same secret
I use to generate my first access_token
.
My questions are :
- Why do we use refresh tokens if they need to much security, while we could just regenerate an access each time it expires?
- It is really just all about checking faster the identity of the one who is sending the request?
I apologies if I am not asking in the right StackExchange site.