Each refresh token is valid for 14 days. Why do the refresh tokens expire?
相关问题
- Obtaining Refresh Token from lepture/Authlib throu
- YouTube API refresh token revoked with 400 code “i
- Azure AD OAuth client credentials grant flow with
- Authenticating to Google Cloud Endpoints as iOS ap
- How to configure resource id in resource server us
相关文章
- Why is redirect_uri required on Access Token reque
- Django REST Framework - OAuth2 Consumer API from e
- Google OAuth 2.0 User id datatype for MYSQL
- Google OAuth 2: response_type error on token reque
- Google OAuth 2 redirect_uri_mismatch - OmniAuth Ra
- Google Chrome extension: How to find out if a user
- Implementing social login in asp.net core 2.2 with
- How do I read claims from my Oauth token?
14 days was based on what is considered best practice in implementing OAuth2. See Why do access tokens expire? for a pretty comprehensive answer about why OAuth2 refresh tokens expire.
We are interested in hearing what number bigger than 14 would work for your application. We picked 14 days based on initial feedback, surveys from application developers, as well as looking at application logins by users. A high majority of users login with apps more often than every 14 days.
Can you explain your use case? What would be the ideal non-infinite refresh-interval that would give you a balance between peace-of-mind about security, and convenience