Explain Access Token and Refresh Token architecture.
Access Token and Refresh Token architecture is a token-based authentication mechanism where a short-lived Access Token grants access to protected resources, and a long-lived Refresh Token is used to obtain new Access Tokens without re-authentication.
In token-based authentication (commonly using JWTs), the Access Token is a short-lived credential (typically 5–15 minutes) sent by the client with each API request to prove authorization. The Refresh Token is a longer-lived credential (days or months) stored securely (e.g., in an httpOnly cookie) and never sent to resource servers. When the Access Token expires, the client presents the Refresh Token to a dedicated endpoint to obtain a fresh Access Token, thereby avoiding repeated login prompts while maintaining security.
This architecture improves both security and user experience. Short-lived Access Tokens limit the window of abuse if a token is stolen. Refresh Tokens are stored more securely and can be revoked independently, enabling features like single logout or detecting token reuse. The token issuance endpoint validates the Refresh Token (signature, expiration, and optional revocation list) before issuing a new Access Token. Optional rotation: each refresh returns a new Refresh Token, invalidating the old one to prevent replay attacks.
- 1
Access Token: Short-lived (minutes), contains claims (user ID, roles), sent in Authorization header, validated on each request, reduces damage if leaked.
- 2
Refresh Token: Long-lived (days/months), stored securely (httpOnly cookie), never exposed to resource servers, used only at token endpoint, allows revocation and rotation.
- 3
Benefits: Enhanced security (limited exposure window), seamless user experience (no frequent logins), scalability (stateless access tokens), and ability to revoke refresh tokens without logging out users prematurely.