As the name implies, a refresh token is a special kind of token that can be used to obtain a new access token; the most logical way to use it is when the former access token expires and the client needs a new one to avoid having to perform the login again. Refresh tokens never expire, although they can--and should--be invalidated as soon as they are consumed, for obvious security reasons; on top of that, they also need to be stored properly to ensure that they are not leaked.
Implementing refresh tokens in our current web application won't be hard at all, as long as we perform the following steps:
- Find a proper way to persist response tokens so that we can add, check, and invalidate them as needed.
- Add a refresh_token ...
