CODEWITHSUNDEEP
restoauthoauth-2.0
plsnoban
plsnoban

Reputation: 351

In OAuth2, why not always use the refresh token?

In OAuth2, to my understanding there is an accessToken - which expires after a relatively short time frame, and a refreshToken - which is used to generate a new accessToken.

My question is, why should I ever go through the trouble of checking whether the accessToken is valid or catching specific token expiry errors, instead of just getting a new accessToken every time with my refreshToken? Are there any downsides to this approach?

Upvotes: 1

Views: 54

Answers (1)

Mohit Mutha
Mohit Mutha

Reputation: 3001

It is technically feasible but creates unnecessary requests to the OAuth server. You can instead do error handling for expired tokens and attempts to retrieve a access token using the refresh token if the you get a expiry error.

That way you do not need to call you Oauth server everytime (saves one request) and call the resource server only. Call the Oauth server only the first time and in case of expiry

Upvotes: 1

Related Questions