Why Refresh Token? - 2 min. OAuth #4

Episode #4 explains why do we have Refresh Token in OAuth 2.0.

Subscribe to the channel to get (hopefully) Weekly video updates on "2 Minutes OAuth" and more.

Video Clips: NHK and Pixabay

[נטעאלקקון]

"It's like refreshing the access token. That's why It's called refresh token" | PRICELESS

[juanjoseramirezcalderon]

why don't attackers just focus on stealing the Refresh token? Won't that give them access to create new access tokens and then steal all other resources?

[dawid_dahl]

Very refreshing explanation. Thank you!

[createawareness]

Nice explained in short time. Thank You

[mohamamdnazim]

I was so confused. But now i think i get it.
Its only makes sense because refresh token is used only in the auth server. otherwise, there is no point of having 2 tokens.

[shrikeshk]

Please make me understand where is refresh token stored ? How does client knows that access token is expired and it should use refresh token to get a new one ?

[TheTanMusic]

The best explanation, thank you very much.

[gamemusicmeltingpot]

if the resource gates are unsecure anyway, wouldn't the attacker just steal your next access token as soon as you use it? Whats the point of giving another access token

[ErnestoVazquezChoby]

Any github repo that already implements jwt, access tokens, and refresh tokens ?

[reilwaystation]

what if the hacker got the refresh tokens instead of access token

[StevenErat]

This was a very useful explanation. Just what I was looking for. But I have to admit, I snorted. Twice.

[richardsonbruno]

the before video Oauth #3 is not avaliable, @Nat Sakimura

[temanangka]

Refresh token is useless if hacker also steal it beside access token! Hacker know this. So, they will steal both. So, why do we need still refresh token?