Is there any benefit in using refresh tokens if your auth and resource server are combined?

I understand the benefit when they are separate: The refresh token is never sent to the resource server, but if they are not is there any?

Without the refresh tokens, the access tokens could still be refreshed the same, but is there some additional benefit of still using separate refresh tokens?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.