The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time.

The setup: There is a client, application server and authentication server.

The client stores the access token in browser. The application server stores the refresh token. The authentication server hands out the refresh + access token. One of the advantages is that a stolen access token can only be used for the time it is valid.

Say a hacker steals the access token that is valid for 30 minutes. When the hacker makes a request with the valid but expired stolen access token after 30 minutes, the application server refreshes it with the refresh token, thus the hacker gaining a new valid and not expired access token.

2 Answers 2


If the hacker uses a valid but, expired token, the authentication server is not supposed to return a new valid token. Instead, the authentication server should return an "Authentication Failure".

On the other hand, the application is supposed to refresh a token before its about to expire. If your token expires in 30 minutes, the valid application is supposed to refresh it before this period.

Depending on the requirements and sensitivity of the information in your application, you should also consider expiring a session entirely if there is no activity from the user for 30 minutes.

  • thank you for the answer!. our use case is we want to provide long extended session for users in our ecom site. so user should be able to refresh after an hour of inactivity too. Cant invalidate a token if it is expired.
    – Illakiya
    Dec 26, 2023 at 14:57

It is safe to store access token, refresh token and ID token in session cookies provided that you are using authenticated encryption before storing them in cookies. From RFC 6265 HTTP State Management Mechanism:

Servers SHOULD encrypt and sign the contents of cookies (using whatever format the server desires) when transmitting them to the user agent (even when sending the cookies over a secure channel).

You can use AES-GCM-256 for authenticated encryption of session cookies and the key is stored by the server. When a user sends a request, you check the validity of the token. If the access token is expired, you should use Silent Authentication to obtain the new access token from the Identity Provider.

If you have a Singe Page App (SPA) then silent authentication can become interruptive for UX, so, a successor solution for SPAs is to use Refresh Token Rotation which issues a new access token and a new refresh token whenever the access token is refreshed.

If the attacker has the capability to hijack session cookies, then consider that device permanently compromised. You cannot prevent session cookie hijacking by rotating the access token and refresh token. The attacker will just hijack the session cookies again.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .