I recently stumbled upon this article which recommends using two tokens for authentication.

Once the user is logged-in (or registered), the client receives an access token and a refresh token, and gets transitioned to the protected scene.

The access token is a credential valid for 1 hour, used to access the protected content from the server API. When it expires, the client uses the refresh token to obtain a new access token. The refresh token is valid for 90 days [...]

I'm guessing using two tokens is a security measure, but I can't imagine how it makes the system any safer. Wouldn't it be equally secure if there was only one token, valid for 90 days, which is used as the access token? What are the benefits of using another token?

  • That question is about two-factor authentication when the user has 2 ways to prove their identity and they have to use both. This question is about computer-generated tokens that the client application handles, and if an attacker had one of them (refresh), they could generate the other (access). I don't think they are the same. Nov 25, 2019 at 12:29
  • 2
    See stackoverflow.com/questions/3487991/…
    – mti2935
    Nov 25, 2019 at 12:31
  • I edited the title to focus answers.
    – schroeder
    Nov 25, 2019 at 12:35
  • 1
    If you search here for "refresh tokens" there are multiple questions with answers that might help you that might serve as duplicates.
    – schroeder
    Nov 25, 2019 at 12:36
  • Possible duplicate of Two-Factor Authentication: When is it worth it?
    – user163495
    Nov 27, 2019 at 20:47


You must log in to answer this question.

Browse other questions tagged .