Can refresh token be stolen?
If the refresh token can be stolen, then so can the access token. With such an access token, the attacker can start making API calls. To make matters even more complicated, access tokens are often self-contained JWT tokens. Such tokens contain all the information needed for the API to make security decisions.
How do I make refresh tokens?
Get an Access Token Using the Refresh Token
- Call the /v2/oauth2/token endpoint and pass the refresh token along with these parameters.
- grant_type —Specify the string refresh_token .
- refresh_token —The refresh token you created.
- valid_for —Number of seconds until the access token expires. Default is 60 seconds.
Can a refresh token be used as an access token?
The refresh token is not an access token it is just an identifier for the access token. Now once the access token is expired, the user can use the refresh token to obtain another short-lived access token and so on. Why not long-lived access token? Now, you may have one question in your mind.
When to invalidate a refresh token in OAuth?
According to a safe policy (for a web client), a refresh token can be invalidated at the time of a request for a new access token, and a new refresh token is also generated by the authorization server and returned to the client. https://tools.ietf.org/html/rfc6749#section-10.4
How to use refresh tokens in ASP.NET Core APIs?
JSONIgnore is an attribute that restricts the property from being shown in JSON results. This is the model that will be returned to the client on request with valid credentials. Now, add the RefreshToken to our ApplicationUser class, so that we can relate / link refresh tokens with specific users on our database.
How are refresh tokens stored in azure key vault?
Securely store only the refresh tokens, with as much rigor as if they were access tokens. If necessary, you can revoke refresh tokens if they become compromised. This solution uses Azure Key Vault, Azure Functions, and Azure DevOps to securely update and store OBO refresh tokens.