Explain Access Token and Refresh Token architecture.

Question

Accepted Answer

In modern applications (especially SPAs, mobile apps, and APIs), the Access Token and Refresh Token pattern separates authorization from long‑term credential storage. An Access Token is a short‑lived credential (typically 5–15 minutes) that proves the user’s permission to access protected resources. It is sent with each API request, often in an `Authorization: Bearer` header. A Refresh Token is a longer‑lived credential (days or months) that is stored securely (e.g., in an httpOnly cookie or a mobile secure storage). When the Access Token expires, the client uses the Refresh Token to request a new Access Token from a dedicated endpoint, avoiding the need for the user to log in again. This architecture limits the damage if an Access Token is stolen, while Refresh Tokens can be revoked or rotated. ```javascript
// 1. Login request
POST /api/auth/login
{ "username": "john", "password": "..." }

// Response
{
  "access_token": "eyJhbGciOiJIUzI1NiIs...", // expires in 15 min
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2...",
  "expires_in": 900
}

// 2. API request with access token
GET /api/user/profile
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

// 3. When access token expires (401 response)
POST /api/auth/refresh
Body: { "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2..." }

// 4. New access token issued
{ "access_token": "eyJhbGciOiJIUzI1NiIs...", "expires_in": 900 }
``` **Access Token** – Short-lived (minutes), contains claims (user ID, roles, scopes), sent with every request, stateless validation, larger attack surface if leaked (but short window). **Refresh Token** – Long-lived (days or months), stored securely (httpOnly cookie or server‑side), never sent to resource servers, used only at the refresh endpoint, can be revoked or rotated. **Benefits** – Enhanced security (short exposure window), seamless user experience (no frequent logins), scalability (stateless access tokens), and ability to revoke refresh tokens for logout or security events. Implementing this pattern properly requires careful security considerations. Refresh tokens should be stored with httpOnly, Secure, SameSite=Strict flags when using cookies. Alternatively, in mobile apps, use secure storage (e.g., Keychain/Keystore). Rotation — issuing a new refresh token each time the access token is refreshed — prevents replay attacks and allows detecting token theft. Servers must store refresh token fingerprints (e.g., hashed) and track their revocation status. Finally, use short access token lifetimes (e.g., 15 minutes) to force frequent refreshes and limit the damage window. ```javascript
// Refresh endpoint with rotation
app.post('/refresh', async (req, res) => {
  const oldToken = req.cookies.refresh_token;
  if (!oldToken) return res.sendStatus(401);

try {
    const payload = jwt.verify(oldToken, REFRESH_SECRET);
    // Check if token exists in DB and is not revoked
    const tokenRecord = await db.findRefreshToken(payload.tokenId, payload.userId);
    if (!tokenRecord || tokenRecord.revoked) {
      // Potential theft – revoke all user tokens
      await db.revokeAllUserTokens(payload.userId);
      return res.status(403).json({ error: 'Token reuse detected' });
    }

// Revoke the old token (rotation)
    await db.revokeToken(tokenRecord.id);

// Issue new tokens
    const newAccessToken = jwt.sign({ userId: payload.userId }, ACCESS_SECRET, { expiresIn: '15m' });
    const newRefreshToken = generateRefreshToken(payload.userId);
    await db.storeRefreshToken(newRefreshToken.tokenId, payload.userId);

res.cookie('refresh_token', newRefreshToken.token, { httpOnly: true, secure: true, sameSite: 'strict' });
    res.json({ access_token: newAccessToken });
  } catch (err) {
    res.sendStatus(403);
  }
});
```

Explain Access Token and Refresh Token architecture.

Access Token and Refresh Token architecture uses short-lived access tokens for resource access and long-lived refresh tokens to obtain new access tokens without re‑authentication, balancing security and user experience.

Explain Access Token and Refresh Token architecture.

Access Token and Refresh Token architecture uses short-lived access tokens for resource access and long-lived refresh tokens to obtain new access tokens without re‑authentication, balancing security and user experience.

Scenario Questions

Follow-up Questions