Contents
What if refresh token is compromised?
The idea of refresh tokens is that if an access token is compromised, because it is short-lived, the attacker has a limited window in which to abuse it. Refresh tokens, if compromised, are useless because the attacker requires the client id and secret in addition to the refresh token in order to gain an access token.
How do I refresh my Facebook access token?
You can not use an expired token to request a long-lived token. If the token has expired, your app must send the user through the login flow again to regenerate a new short-lived access token.
When should you refresh access token?
Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope.
How do I get a short live access token?
Go to https://developers.facebook.com/tools/explorer/ and select your app from the first drop down menu, in the left. Click on the button “Get access token”, and in the “Select Permissions” window, click in “Extended Permissions” and check manage_pages and publish_stream, and click in “Get Access Token” blue button.
What happens when an azure access token expires?
If the authentication protocol allows, the app can silently reauthenticate the user by passing the refresh token to the Azure AD when the access token expires. Azure AD then reevaluates its authorization policies. If the user is still authorized, Azure AD issues a new access token and refreshes token.
How long does a refresh token stay active?
The refresh_token is active for 336 hours (14 days). After the access_token expires, an active refresh_token can be used to get a new access_token / refresh_token pair as shown in the following example. This cycle can continue for up to 90 days after which the user must log in again.
Can a Azure AD revoke a session token?
It’s possible that the app may never send the user back to Azure AD as long as the session token is valid. For a session token to be revoked, the application must revoke access based on its own authorization policies. Azure AD can’t directly revoke a session token issued by an application.
What is the error ” we could not refresh your credentials “?
My email address has changed and now I can’t log into Visual Studio 2017. The error is “We could not refresh the credentials for the account. Failed to refresh the access token”. How can I fix this? This bug will be fixed in a future version.