From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will only be able to use it for a very short duration of time.

However, because refresh tokens and access tokens are usually stored in the exact same way on client-side/JavaScript apps, usually on local storage or session storage, the effort/difficulty of stealing the refresh token is the same as the access token, which means that an attacker can steal the refresh token as easily as he would be able to steal the access token and thus request as many access tokens as he wants until the refresh token expires.

If this is true, then what real difference is there between having a long lived refresh token and a short lived access token versus just having a long lived access token on client-side/JavaScript apps? You could store the refresh token in a secure http-only cookie to prevent XSS attacks but you could do the exact same thing with access tokens.


You're correct. If refresh token is stored in same vault as access token, the distinction between the two is diluted.

In https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/ is a phrase "Refresh tokens are usually subject to strict storage requirements to ensure they are not leaked".

If your application is compromised by attacker, you will anyway be in trouble. Still there exist scenarios where having separate token for access and refresh is beneficial as the attacker cannot access the refresh token.

Again, there are number of scenarios where the phrase from question "attacker can steal the refresh token as easily as he would be able to steal the access token" holds true.

To answer the original question is: Every improvement in security is an improvement no matter how small they are!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.