Why use long-lived refresh tokens if access tokens expire quickly?
I'm trying to understand the purpose of access tokens and refresh tokens. If access tokens are deliberately short-lived to limit the damage from theft, doesn't using a long-lived…
refresh tokens
Why Use Short-Lived Access Tokens If Refresh Tokens Last Much Longer?
I'm trying to understand the security reasoning behind access and refresh tokens. If access tokens are intentionally short-lived to limit the damage from theft, doesn't a long-lived refresh…
Did I handle a potential security issue with hardcoded Google tokens correctly?
I found some hardcoded Google credentials in a third-party app for an online shop, including access and refresh tokens, and I was shocked to see they weren't encrypted.…
What are the downsides of using JWT if we can handle token invalidation?
I've been looking into the differences between JWT (JSON Web Tokens) and session-based authentication methods. I came across an article that discussed the invalidation problem with JWTs, which…
Getting Started with Google Auth: Refresh Tokens and Storage
Hey everyone! I've been relying on email and password for authentication in my apps, but now I'm looking to integrate OAuth providers, starting with Google. I've checked out…