Contents
Where is the refresh token stored?
Access token and refresh token shouldn’t be stored in the local/session storage, because they are not a place for any sensitive data. Hence I would store the access token in a httpOnly cookie (even though there is CSRF) and I need it for most of my requests to the Resource Server anyway.
How do you refresh a Keycloak token?
There are 2 ways to deliver an access token:
- user customer authenticating to keycloak throughout the client app. (This is generating a id_token and optionally access token as soon as user customer is authenticated)
- Using an offline token to request a refresh token, and from the refresh token an access token.
How can I store oauth tokens in database?
1 Answer. A solution for this is to encrypt the data before is saved into the database and decrypt it each time you need to access it. In your case I think that symmetric encryption is the correct choice, thus you will need to have a private key that must be kept safe at all times.
Do you need a refresh token for OIDC?
Working an application requires Refresh Token from OIDC (keycloak) to get authorisation for accessing resources. But it seems like the RefreshToken that returned seems to be expired or leaking.
How to send a refresh request to Keycloak?
Essentially on all requests the tokens in the cookie can be validated. you can check for an expired access token, and in that case send a refresh request to keycloak… the access token will be provided and you can update the cookie with the updated access token and refresh token.
How does a Keycloak application authenticate a user?
The first is an application that asks the Keycloak server to authenticate a user for them. After a successful login, the application will receive an identity token and an access token. The identity token contains information about the user such as username, email, and other profile information.
What are two use cases for OIDC server?
There are really two types of use cases when using OIDC. The first is an application that asks the Keycloak server to authenticate a user for them. After a successful login, the application will receive an identity token and an access token.