2

This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android).

The user using the mobile app (in the future) will be able to authenticate via Facebook, Google, etc, and store in the database some information received from the social networks necessary for the app.

I implemented the authentication by providing username and password(saved on a database) and by releasing an access token (JWT) from the backend, used by both frontend at every REST request to Spring Boot.

Now I would like that for the user's mobile app not to be entered username and password every time, but to remain logged in for "always".

Reading on the internet I saw that it is possible to generate a refresh token that the app can use when the backend (Spring Boot) returns HTTP Error 401. The app uses the refresh token to ask the backend for a new access token. If the refresh token has also expired then the user is forced to re-enter the username and password otherwise if it remains logged.

When does the refresh token need to be updated? Because otherwise when the refresh token expires I have to force the user to enter the credentials.

Which flow is correct and secure?

If not sure what should I use?

Thks

Improve this question

1 Answer 1

Reset to default
-1

The lifetime of a refresh token depends on your configuration. Some frameworks provide forever lasting refresh tokens. Then there are others which provide refresh tokens that expire after 90 days of inactivity. There is also an option to rotate refresh token after every request.

As for the two approaches that you mentioned:
Which one is correct depends on your preferences and whether you can ensure a secure store for your refresh tokens or not. There are several options available to securely store your tokens for a mobile app and I believe encrypted cookies can do the job for you on the web app as well.

Which one is more secure? I would say that just using the access token is more secure. The reason being, if your access token is leaked, malicious users can use it only till it expires which is a lot quicker than your refresh tokens. If a refresh token expires, a malicious user can generate new access tokens to access your APIs.

Having said that, it should not deter you from using refresh tokens. If you use them securely, they can help you provide a good user experience.

Improve this answer
3
  • What exactly is an encrypted cookie and how does it protect against token theft?
    – Conor Mancone
    Mar 27, 2021 at 11:09
  • It's unreasonable to make a blanket suggestion against refresh tokens. Considering that almost all the biggest websites use some mechanism for remembering users long term, the internet seems to disagree with your suggestion
    – Conor Mancone
    Mar 27, 2021 at 11:11
  • @ConorMancone I did say that if you use refresh tokens securely, they can help you provide a good user experience.
    – Limit
    Mar 28, 2021 at 1:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .