How to Implement Refresh Token in ASP.NET Core Web API

In this video, we are going to learn about refresh tokens, their use in modern web application development, and how to implement this feature in the .NET Web API using the latest framework.

Refresh tokens are credentials that can be used to acquire new access tokens. When an access token expires, we can use a refresh token to get a new access token from the authentication component. The lifetime of a refresh token is usually set much longer compared to the lifetime of an access token.

LINKS MENTIONED IN THE VIDEO

FOLLOW US ON SOCIAL MEDIA!

[CodeMaze]

Thank you all for watching and for your support.

[ElohimCode]

You made refreshtoken implementation simpler. Thanks for sharing 😊

[Sharondevbd]

Great! I Hope I Founded the right Tutorial & Channel

[I-PixALbI-I]

Just yesterday implement refresh token but a bit different, using cookies for refresh token.
Thx for video!

[zameer.vighio]

Thanks first.

Excellent way of explaining

[tanoryjakaperdana]

Why if token.expire<= now ? Doesnt refresh token help the user to generate new token if the one their have expired?

[alexalexander]

Hello, great video. Thou I can not get the following. What is "principal.Identity.Name" construction in RefreshToken method? Where does this "identity" property comes from? As you did not populate this prop when creating GetClaimsPrincipalFromToken method. I have a NULL in this value.

[johannes]

I have a question. When I have a MAUI app as the client, for example, what is the best practice for the refresh flow to maintain a high user experience? Because when the access token is invalid, it would take six calls until I have the data if the token needs to be refreshed. So, should the token be refreshed in the background if it’s expired to maintain a high UX?

[salihe]

why are we encyrpting refresh token with RandomNumberGenerator Class can't we make that JWT too

[coder]

if someone gets hold of refresh token would they not able to use it to generate as many access tokens as they want?

[ahmedrizk]

this approach does not support user logging from multiple clients since there is only one refresh token/user at a time then once the first client consume it the second client will log out the user.

[Famouse]

Can you give a link to the source code?