ASP.NET Core Web API Interview Question #67
What is a refresh token?
Authentication, Authorization, JWT & API Security Mid-Level Intermediate
Quick Interview Answer
A refresh token is a credential used to obtain a new access token without requiring the user to perform the full authentication flow again. Access tokens are typically shorter-lived, while refresh tokens require stronger storage and lifecycle controls.
Detailed Explanation
A refresh token is a credential used to obtain a new access token without requiring the user to perform the full authentication flow again. Access tokens are typically shorter-lived, while refresh tokens require stronger storage and lifecycle controls.
Refresh-token design should include rotation or reuse protection where appropriate, revocation, expiration, secure storage, and server-side validation. Refresh tokens should not be treated as ordinary API access tokens.
Code Example
POST /connect/token
grant_type=refresh_token
refresh_token={refresh_token}
// Identity provider returns a new access token
// and possibly a rotated refresh token.