CODEWITHSUNDEEP
djangooauth
Luiz de Prá
Luiz de Prá

Reputation: 1475

It is normal for an OAuth2 implementation to create a new access token every authentication?

I'm using an OAuth 2.0 implementation (django-ouath-toolkit) and I noticed that every time an user request a access token I get a new registry in my database. This is a normal behaviour? They should not be recycled/replaced by application and user every authentication request? If an user logs in 5 times in a row, all the 5 returned access tokens will be stored and will be valid until it expires. If it is relevant, I'm using password grant type and public client type.

Thank you all.

Upvotes: 0

Views: 47

Answers (1)

Vilmantas Baranauskas
Vilmantas Baranauskas

Reputation: 6726

Yes, this is the common practice: New Access-Token is created on each authentication request.

It is, however, somewhat uncommon that user would log in 5 times in a row.

Upvotes: 1

Related Questions