I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication).
- Access tokens: stored in the client (localstorage). Expire in 20 minutes.
- Refresh tokens: stored in the client (localstorage), and in the server (database). Expire in 3 months.
- The refresh "window" is a week, so tokens can be refreshed without re-login within that week.
- After 3 months the refresh token expires, so the user must re-login.
When the user logs out, I delete the access and refresh tokens from localstorage. But I should also delete the refresh token on the server, so I must make a /logout
request to the server.
Should that logout request be authenticated?
Let's say yes. The problem is that if the user is not logged in (i.e. the access token has expired), and the refresh window has passed (let's say, a week), then an automatic refresh can't be performed, so he would be forced to log in, so that he can log out. Weird!
The alternative is for that endpoint to expect an access and refresh token pair, BUT 1) to allow the access token to be expired, and 2) to ensure the access token is nonthelesss valid, and that the refresh token is both valid and current. And in that case, to delete the refresh token from the database.
What is the typical way to handle this? Are there pros/cons I've not considered?