How are refresh tokens secure?
Since web applications are more straightforward to compromise than native applications, refresh tokens require additional protection. In a nutshell, RTR makes refresh tokens only valid for one-time use. Each time a refresh token is used, the security token service issues a new access token and a new refresh token.
Is refresh token rotation secure?
Auth0 now offers an alternative–Refresh Token Rotation–that provides a secure method for using refresh tokens in SPAs while providing end-users with seamless access to resources without the disruption in UX caused by browser privacy technology like ITP.
Do you need a refresh token for access token renewal?
Yes, you read that right. This new development is awesome, because it makes access token renewal much more elegant. However, refresh tokens in the browser require additional security measures, such as refresh token rotation. We discuss the pros and cons of refresh token rotation, along with the potential dangers.
When to use token based authentication for spas?
When your SPA bootstraps, you attempt to access this endpoint. If you get back a successful response you continue with the bootstrap. If you do not, you know that the user needs to authenticate. Take advantage of the response body when you are responding to a credential exchange.
How does RTR work with refresh tokens?
In a nutshell, RTR makes refresh tokens only valid for one-time use. Each time a refresh token is used, the security token service issues a new access token and a new refresh token. With the new access token, the client can make API calls on behalf of the user, and with the refresh token, it can run a new Refresh Token flow when needed.
When to use refresh tokens for silent authentication?
Beyond silent authentication, another technique for getting new access tokens is to use Refresh Tokens (RTs), which are typically long-lived and are used to request new ATs after the shorter-lived ATs expire.