Authentication interview question · Most asked
How do refresh tokens work, and how do you secure them?
Summary
A refresh token is a longer-lived credential used only at the token endpoint to obtain new short-lived access tokens without re-login. Secure it with rotation (each use issues a new one and invalidates the old), reuse detection, binding to the client, secure storage (HttpOnly cookie or secure OS storage) and server-side revocation.
Longer Answer
If a rotated (already used) refresh token is presented again, assume theft and revoke the whole token family. Set absolute and idle lifetimes, revoke on logout and password change, and never send refresh tokens to resource APIs.
Key Points
- Only used at token endpoint
- Rotation + reuse detection
- Secure storage
- Revoke on logout/password change
More most-asked Authentication questions
- What is the difference between authentication and authorization?
- Compare session-based authentication with token-based (JWT) authentication.
- What are the most common JWT security pitfalls?
- What are OAuth 2.0 and OpenID Connect, and how do they differ?
- Explain the OAuth 2.0 Authorization Code flow with PKCE.
- How should passwords be stored?
- What is multi-factor authentication, and which factors are strongest?
- How do you secure session cookies?