According to this community discussion, SPA’s don’t use refresh tokens. So why does my SPA application have a setting for “Refresh Token Lifetime (Absolute)” in the Auth0 application settings? [image]

Hi @dedicatedmanagers , SPAs didn’t use refresh tokens at the time of that thread…but they can now. With the release of rotating refresh tokens SPAs are able to work with a refresh token, although a different type of refresh token than the non-rotating, non-expiring refresh tokens of old. It looks …

If SPA's don't use refresh tokens, why is there a setting for them?

Get Help

system Closed August 12, 2020, 9:11pm 6

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
SPA & Refresh Token Get Help auth0 , spa , refresh-tokens	4	3096	May 27, 2020
How does auth0-spa-js store tokens Get Help refresh-tokens	8	16746	September 27, 2019
New auth0 spa js Get Help	4	3187	October 4, 2019
Is this SPA authentication flow secure? Get Help password , authentication	10	6340	March 2, 2018
Rotating refresh token locking users out after expiry Get Help	5	6697	November 25, 2020

If SPA's don't use refresh tokens, why is there a setting for them?

Related topics