0

Laravel Passport implements OAuth2 flows and does the usual thing of issuing access tokens in JWT format, and an opaque random string as the refresh token. These refresh tokens are enormous - around 710 hex bytes, 2,840 bits – which seems really excessive. They are not stored at all in the server-side DB, only a hash of them, so this length seems to amount to a traffic-generating exercise.

If they are really random strings, what motivation or benefit might there be to make them so big?

0

You must log in to answer this question.

Browse other questions tagged .