When does a refresh token become invalid?

Hi @kenichi.sugiyama.re

Disabling refresh token rotation is NOT recommended. This is for security. If a refresh token is somehow leaked and used, the refresh token rotation will prevent additional compromise. If you turn off refresh token rotation, and an attacker gets a refresh token, they have a lifetime supply of access tokens.

And if you turn on rotation, you cannot disable the absolute expiration.

I do not think that changing the settings invalidates the current refresh tokens or sessions, but I haven’t tested that.

I’d just set the absolute expiration to the maximum time (1 year maybe?)

John

1 Like