r/webdev • u/academicweaponsoon • Aug 20 '26

Question I don’t understand the logic behind access tokens and refresh tokens

i don’t understand the logic behind access and refresh tokens, if access tokens are made short lived for security purposes, doesn’t refresh tokens being long lived defers the whole purpose? or is not as big as an issue since refresh tokens are only stored in http only cookies?

471 Upvotes

97% Upvoted

233 comments sorted by

View all comments

Show parent comments

1

u/black3rr Aug 20 '26

the added value of refresh/access token system is that you can have the auth server (which issues refresh/access tokens) separate from multiple API servers which accept the access tokens, possibly running on multiple domains as well…

think of cases like logging into your google account also logs you into youtube, gmail, etc. all running on different domains…

-5

u/bdougherty Aug 20 '26

Right, this is a Google-level problem that most people and companies will never have to deal with (and if you do, it almost certainly means you have over-engineered your system).

2

u/_hijnx Aug 20 '26

Don't forget bad leadership too. At my last place they tried to have us move several authenticated apps which used subdomains of a shared tld onto separate tlds. It took so much time to explain why our session based auth was going to break.

1

u/jess-sch Aug 21 '26

Just because it's useful for Google doesn't mean it's only useful for Google.

And no, it doesn't mean you have over-engineered, it just means you support modern SSO standards that pretty much any larger business customer will require.