Contents
What is the purpose of an OAuth refresh token?
A Refresh Token is a central part of OAuth, and consequently, OpenID Connect. It is a kind of token that can be used to get additional access tokens. It is a sort of “token granting token” in that it can be sent to the OAuth server to obtain new ones. Refresh tokens can be thought of like a password of sorts.
Why does the client credentials grant type not use refresh tokens?
The issuance of a refresh token with the client credential grant has no benefit. That is why the RFC6749 section 4.4. 3 indicates A refresh token SHOULD NOT be included . Thus its issuance is at the discretion of the authorization server.
Which OAuth grant type refresh token?
Spec-conforming grants
| Grant Type | Description |
|---|---|
| authorization_code | Authorization Code Grant |
| client_credentials | Client Credentials Grant |
| password | Resource Owner Password Grant |
| refresh_token | Use Refresh Tokens |
What is the advantage of using refresh token?
A refresh token can help you balance security with usability. Since refresh tokens are typically longer-lived, you can use them to request new access tokens after the shorter-lived access tokens expire.
What is client credentials grant?
The Client Credentials grant type is used by clients to obtain an access token outside of the context of a user. This is typically used by clients to access resources about themselves rather than to access a user’s resources.
Can a client provide a refresh token to an OAuth server?
Refresh Tokens. Not knowing much about refresh tokens, i immediately assumed that a client would be able to provide the OAuth Server the refresh_token to retrieve a fresh Access_Token. This is ‘kind of’ correct.
When do you not need a refresh token?
When using the client credentials grant, the client application authenticates to the authorization server using its client id and client secret. It gets back an access token for the resource if authorized. There’s no user interaction in this scenario, so there’s no need to issue a refresh token.
How does OAuth 2.0 client credentials grant flow work?
These types of applications are often referred to as daemons or service accounts. The OAuth 2.0 client credentials grant flow permits a web service (confidential client) to use its own credentials, instead of impersonating a user, to authenticate when calling another web service.
What happens when an access token expires?
When the access token expires, the client can use its own credentials to request a new token. Refresh tokens are used when the client want to access a resource on behalf of the user (which may not be interacting with the client at that time). In this case, the client is acting on its own behalf.