Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[update] added feedback by sandrino #672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntotten merged 1 commit into from
Dec 21, 2015
Merged

[update] added feedback by sandrino #672

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion landings/modules/rtokens-security-considerations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@ imagePosition: "center"
color: "#4E92DF"
title: "Security Considerations"
---
**Refresh Tokens** are long-lived. This means when a client gets one from a server, this token must be stored securely to keep it from being used by potential attackers. If a **Refresh Token** is leaked, it may be used to obtain new **Access Tokens** (and access protected resources) until it is either blacklisted or it expires (which may take a long time). **Refresh Tokens** must be issued to a single authenticated client to prevent use of leaked tokens by other parties. **Access Tokens** must also be kept secret, but due to its shorter life, security considerations are less critical.
**Refresh Tokens** are long-lived. This means when a client gets one from a server, this token must be stored securely to keep it from being used by potential attackers, for this reason it is not safe to store them in the browser. If a **Refresh Token** is leaked, it may be used to obtain new **Access Tokens** (and access protected resources) until it is either blacklisted or it expires (which may take a long time). **Refresh Tokens** must be issued to a single authenticated client to prevent use of leaked tokens by other parties. **Access Tokens** must also be kept secret, but due to its shorter life, security considerations are less critical.