What are Refresh Tokens?! and...How to Use Them Securely

In this video we will explore the concept of refresh tokens, learn how they compare to other token types, and understand how they let us balance security, usability, and privacy.

*Check out the corresponding blog post to this video here:*

*Auth0 Token Best Practices doc:*

*Chapters:*
00:00 Introduction
00:40 What is a Token?
02:04 What is a ID Token?
02:53 What is an Access Token?
04:56 What is a Refresh Token?
05:55 When to Use Refresh Tokens?
06:40 Authorization and Authentication Flows
08:50 Refresh Token Rotation
09:11 Keeping Refresh Tokens Secure
10:29 Refresh Token Rotation
11:38 Refresh Token Automatic Reuse Detection
14:52 Using Refresh Tokens to Balance Security, Convenience and Privacy
16:05 Locally Storing Your Refresh Tokens?!
17:54 Token Best Practices
18:50 Conclusion

#security #authentication #developer
___________________________________________
Learn with Auth0 by Okta
___________________________________________
Follow Us on Social

[twd]

that's genius, you explained what I was working for it for three months, thanks bro❤!!!

[KulcsarRudolf]

Super clear, thank you for this awesome video! I feel smarter.

[jesterflint]

This video has enough information to tell you "refresh tokens are very powerful" and they also tell you "auth0 takes measures to secure it" (which satisfies their goal I guess). The main difference between access tokens and refresh tokens is that the refresh tokens are stored in the database and the server can invalidate them at will. So, if a user changes password or the refresh token is compromised, the refresh token can be revoked and the bad actor loses access as soon as the access token expires.

[luisvillar]

Thank you sir for making this video informative and fun to watch.

[marvellstudio]

One of the best video I have watched 👌❤ loved the way you explained

[pawelbrzosko]

Great vid, informative and very entertaining. Well done, Sir!

[rdoojgg]

Hi, I'm trying to understand since I'm building an app in Php and I have to use a rest service, I have the service to request a token that also returns the refresh token, ¿Should I request the token, store it in a database and every time I request the token, before checking if I have a valid one in the database based on the expiration date? ¿What would the refresh token be used for?

Thanks for all

[rahulganga]

Sir, thanks you very much, I have been searching for long for this😂 ...
From India 🇮🇳 ♥️

[bobobobo-kifw]

thank you for the content you are very knowledable. Mini tip that would help so much is to use tables charts eg for part about which auth flow ot use.

[SunnyHenry]

Awesome and easy to understand! Thank You Very Much! I do have one question though, that I can't seem to find the answer to. For refresh token rotation, is it a sliding rotation? Meaning when I get a new refresh token is the expiration pushed back further than the initial expiration? Or is there a way to configure it to, regardless of how many refresh tokens I get, have a combined expiration of... let's say 30 days?

[jimkk]

Awesome viedo! However, I wonder if the token family break the server stateless?

[tuanleanh]

Thank you, the video gives me the answer for how to secure refresh tokens.

[omphemetsemafoko]

Good explanation. Thanks. God bless you

[techytipsnow]

It was a great session, easy to understand comparing with others

[adelkedjour]

If both the access token and refresh token have expired at the same time (i.e., after 15 minutes), it presents a challenge because the client can no longer use the expired refresh token to obtain a new access token. In this case, the user would need to re-authenticate to obtain a new pair of tokens innit?

[maneshipocrates]

Clearly explained. Thanks. But, but how can a beginner get an example of using Okta and spring boot 3 microservices?

[tamashercz]

Thought I was tripping when I saw the guy's beard starting to grow grey towards the end of the video lol.

[uziqmyk]

What happens if a malicious person gets their hands on the refresh token, but the actual user doesn't make a request for quite some time? Wouldn't that let the malicious person misuse the long-lasting refresh token? While I do agree that rotating refresh tokens can enhance security, I'm curious about how this specific scenario would be managed.

[cn]

What happens in 12:07, if the malicious user authenticated with the stolen refresh token before the legitimate user does? Wouldn't the melicious user then have a legit access token to impersonate the legit user?

[zeffali]

How the heaven I generate.a new refrsh token ? Am noob