CODEWITHSUNDEEP
oauth-2.0refresh-tokenonlinebanking
mfaani
mfaani

Reputation: 36427

Is it ever reasonable to revoke a refresh token after a period of time?

I read here I wonder should the server ever just revoke refresh token after a certain period of time and just force the user to login again? I can't remember when was the last I had to enter my login credentials for my Gmail.

What do banks (or any site that stores sensitive data) do if a given user refreshes their token for 200 days? Should they allow the user to continue to use the site? I understand it involves user interaction, so it's not something that is easy to automate.

Upvotes: 0

Views: 309

Answers (1)

Gary Archer
Gary Archer

Reputation: 29326

The refresh token lifetime (or enablement) is decided by an administrator who controls the assets - not by the end user.

Use of short lived tokens is preferred - it is technically simple and zero maintenance

Upvotes: 0

Related Questions