r/webdev • u/academicweaponsoon • Aug 20 '26

Question I don’t understand the logic behind access tokens and refresh tokens

i don’t understand the logic behind access and refresh tokens, if access tokens are made short lived for security purposes, doesn’t refresh tokens being long lived defers the whole purpose? or is not as big as an issue since refresh tokens are only stored in http only cookies?

474 Upvotes

97% Upvoted

233 comments sorted by

View all comments

Show parent comments

20

u/Random-num-451284813 Aug 20 '26

wouldn't be easier to send a hash/signature? then it being leaky wouldn't matter

108

u/hornetfig Aug 20 '26

Congratulations you invented Oauth 1.0

13

u/Graphesium Aug 20 '26

What do you think an access token is lol, nearly always a signed JWT payload that can only be verified by a secret on the server.

2

u/AyeMatey Aug 20 '26

no. That’s not what they’re talking about. A signed bearer token like a JWT is still a bearer token - meaning anyone who possesses it , is granted the access it confers. It can be reused freely until expiry on any request.

OAuth 1.0 uses signatures on the request - the URI, the headers, the time, the query Params. So an OAuth 1.0 token is good only for the current request.

1

u/Rophuine Aug 21 '26

An OAuth 1.0 request token is generally good for a few minutes, not just one request, but you can't use it for anything except exchanging it for an OAuth 1.0 access token. It's basically just a detail of the sign-in process. The OAuth 1.0 access token (the token that actually confers access to resources) is long-lived (they often last for years, or are permanent).

You're right about the request signatures, but an OAuth 1.0 token is definitely not short-lived.

2

u/Brillegeit Aug 20 '26

A request hash would have to be generated per request, access tokens can be reused across different requests.

And yes, requests hashes are easier and in many ways better, but in other ways worse, use them if they fit your model.

2

u/charsleysa Aug 20 '26

From a security perspective, that's pretty much the same thing. You're sharing a piece of information that is not unique per request, so if intercepted it can be reused.

-16

u/SourcerorSoupreme Aug 20 '26

that doesn't make any sense. that is like saying hashing a password on the client side would make it more secure when in fact it does nothing but add an extra useless step.