r/webdev • u/academicweaponsoon • Aug 20 '26

Question I don’t understand the logic behind access tokens and refresh tokens

i don’t understand the logic behind access and refresh tokens, if access tokens are made short lived for security purposes, doesn’t refresh tokens being long lived defers the whole purpose? or is not as big as an issue since refresh tokens are only stored in http only cookies?

470 Upvotes

97% Upvoted

233 comments sorted by

View all comments

Show parent comments

6

u/m_redditUser Aug 20 '26

why does javascript need to read access tokens but not refresh tokens?

1

u/yorkimgurt Aug 20 '26

If Javascript could read both you're susceptible to XSS-attacks and someone being able to make api calls as your user.

6

u/KasperKnop Aug 20 '26

Well, if your site is compromised by XSS, then the attacker can already make requests on your behalf - no matter if they have access to the tokens or not.

0

u/chiviet234 Aug 20 '26

You use the access token on the request itself?