Explain Access Token and Refresh Token architecture.

Question

Accepted Answer

In token-based authentication (commonly using JWTs), the Access Token is a short-lived credential (typically 5–15 minutes) sent by the client with each API request to prove authorization. The Refresh Token is a longer-lived credential (days or months) stored securely (e.g., in an httpOnly cookie) and never sent to resource servers. When the Access Token expires, the client presents the Refresh Token to a dedicated endpoint to obtain a fresh Access Token, thereby avoiding repeated login prompts while maintaining security. This architecture improves both security and user experience. Short-lived Access Tokens limit the window of abuse if a token is stolen. Refresh Tokens are stored more securely and can be revoked independently, enabling features like single logout or detecting token reuse. The token issuance endpoint validates the Refresh Token (signature, expiration, and optional revocation list) before issuing a new Access Token. Optional rotation: each refresh returns a new Refresh Token, invalidating the old one to prevent replay attacks. ```javascript
// POST /api/auth/login
// Response:
{
  "access_token": "eyJhbGciOiJIUzI1NiIs...", // expires in 15 min
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2...", // stored in httpOnly cookie
  "expires_in": 900
}

// Subsequent API request with expired access token → 401 Unauthorized
// Client calls POST /api/auth/refresh with refresh_token (cookie)
// Server responds with new access_token

// Refresh endpoint logic (Node.js)
app.post('/api/auth/refresh', async (req, res) => {
  const refreshToken = req.cookies.refresh_token;
  if (!refreshToken) return res.sendStatus(401);
  try {
    const payload = jwt.verify(refreshToken, process.env.REFRESH_SECRET);
    const newAccessToken = jwt.sign(
      { userId: payload.userId },
      process.env.ACCESS_SECRET,
      { expiresIn: '15m' }
    );
    // Optional: rotate refresh token
    const newRefreshToken = jwt.sign(
      { userId: payload.userId },
      process.env.REFRESH_SECRET,
      { expiresIn: '7d' }
    );
    res.cookie('refresh_token', newRefreshToken, { httpOnly: true, secure: true, sameSite: 'strict' });
    res.json({ access_token: newAccessToken });
  } catch (err) {
    res.sendStatus(403);
  }
});
``` Access Token: Short-lived (minutes), contains claims (user ID, roles), sent in Authorization header, validated on each request, reduces damage if leaked. Refresh Token: Long-lived (days/months), stored securely (httpOnly cookie), never exposed to resource servers, used only at token endpoint, allows revocation and rotation. Benefits: Enhanced security (limited exposure window), seamless user experience (no frequent logins), scalability (stateless access tokens), and ability to revoke refresh tokens without logging out users prematurely.

Explain Access Token and Refresh Token architecture.

Access Token and Refresh Token architecture is a token-based authentication mechanism where a short-lived Access Token grants access to protected resources, and a long-lived Refresh Token is used to obtain new Access Tokens without re-authentication.

Explain Access Token and Refresh Token architecture.

Access Token and Refresh Token architecture is a token-based authentication mechanism where a short-lived Access Token grants access to protected resources, and a long-lived Refresh Token is used to obtain new Access Tokens without re-authentication.

Scenario Questions

Follow-up Questions