I'm trying to improve security in my single page application. Before I had only one JWT that was stored in the browser's localStorage and expired in one day.

I've improved security by adding refresh token.

Right now access token lives for 5 minutes and is stored only in the browser's memory, while refresh token lives for a day, and is being stored as an httpOnly cookie.

Since access token lifespan is so short and it is saved only in memory, we can think that it is secured now, so I should only care for the refresh token security now.

Because refresh token is an httpOnly cookie - XSS attacks won't work, because JavaScript can't get access to the httpOnly cookies.

The question is - if refresh token is secured by means of httpOnly, why do I even need the access token now? Can't I just have refresh token that is already secured and lives for long enough, so users don't need to log in every 5 minutes?

If no, then what benefits having access token along with refresh token provides?

p.s. I'm speaking specifically about the case when each user needs only one access token at a time to access a specified set of resources on the server

1 Answer 1


It can be necessary to prevent access to the resource server for some user, for instance, if user believes that the account was compromised.

One option would be to store each access token in some global storage (like database or distributed cache). To revoke such access token, it is sufficient to delete it from the storage. Revocation would have an immediate effect. Refresh token would be not needed. But this global storage would need to be accessed each time the resource server is accessed. This would reduce performance.

Another option is to simplify validation. One verifies the token signature and then the expiration date. This does not require any global storage for tokens and improves performance. But such token cannot be revoked. To reduce the risk of negative consequences in case the account was compromised, the expiration period is set to a relatively short value like 5 min. Afterwards the user needs to get a new access token. Asking user to login every few minutes would mean a poor user experience. That's why refresh token is used. In case the access needs to be revoked, the authentication server will not issue a new access token. Refreshing the access token reduces performance. But if it happens relatively rare, it is considered acceptable.

what benefits having access token along with refresh token provides?


  1. Better performance, because validation is quicker
  2. The possibility to revoke access after relatively short period of time

You can find further details here: How does a short-lived Access Token add security?

Also see here:

The main benefit of this approach is that the service can use self-encoded access tokens which can be verified without a database lookup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .