UpdatedAug 2, 2026

Refresh Tokens

Why This Is Asked

JWT-based authentication is standard, but Access Tokens should be short-lived. Interviewers want to know if you understand how to maintain a user’s session securely without forcing them to log in every few minutes.

Key Concepts

Access Token: Short-lived, used for authorization in every request.
Refresh Token: Long-lived, used only to obtain a new Access Token.
Security: Refresh tokens are usually stored in a database and can be revoked.
Rotation: Issuing a new refresh token every time one is used to mitigate the risk of token theft.

Answers by Technology

+ Add Variant

Expected Answer (.NET 10 / C# 14)

A Refresh Token is a long-lived credential used to obtain new Access Tokens (JWTs) without requiring the user to re-enter their password.

Why use it?: Access tokens are short-lived (e.g., 15 mins) for security. If stolen, they expire quickly. Refresh tokens allow the app to stay logged in while keeping the attack window small.
Workflow:
1. Client sends Refresh Token to /refresh endpoint.
2. Server validates it against a database.
3. Server issues a new Access Token (and optionally a new Refresh Token).

Why It Matters

Without refresh tokens, users would have to log in constantly, or you’d have to make Access Tokens long-lived, which is a major security risk (since JWTs cannot be easily revoked before they expire).

Code Example

public class User
{
    public string RefreshToken { get; set; }
    public DateTime RefreshTokenExpiry { get; set; }
}

// Logic in AuthController
if (user.RefreshToken == providedToken && user.RefreshTokenExpiry > DateTime.UtcNow)
{
    var newAccessToken = GenerateJwt(user);
    var newRefreshToken = GenerateSecureRandomString();
    
    user.RefreshToken = newRefreshToken; // Rotation
    _db.SaveChanges();
    
    return Ok(new { AccessToken = newAccessToken, RefreshToken = newRefreshToken });
}

Common Mistakes

Storing Refresh Tokens in LocalStorage: It’s safer to store them in an HttpOnly, SameSite=Strict cookie to prevent XSS attacks.
Not Revoking Tokens: If a user logs out or changes their password, all their active refresh tokens should be deleted from the database.

Follow-up Questions

What is Refresh Token Rotation? (Answer: Issuing a new refresh token every time the old one is used, which helps detect if a token was stolen).
Where are Access Tokens usually stored? (Answer: In memory or as short-lived cookies).

Expected Answer (Java 26 / Spring Security)

A Refresh Token allows a client to obtain new Access Tokens without re-authenticating the user.

Storage: Unlike Access Tokens (which are usually stateless JWTs), Refresh Tokens are often stored in a database (e.g., Redis or RDBMS) to allow for Revocation.
Implementation: In Spring Security, this is often handled by a custom TokenProvider or by using Spring Authorization Server.

Why It Matters

It balances security and UX. Access tokens can be extremely short-lived (5-10 mins). If a user’s browser is compromised and the JWT is stolen, the attacker only has a small window. The Refresh Token is kept in a more secure place (like an HttpOnly cookie) and can be invalidated by the server if suspicious activity is detected.

Code Example

public class TokenResponse {
    private String accessToken;
    private String refreshToken;
}

// Logic in a RefreshService
public TokenResponse refresh(String refreshToken) {
    RefreshToken token = repository.findByToken(refreshToken)
        .filter(t -> t.getExpiryDate().isAfter(Instant.now()))
        .orElseThrow(() -> new TokenException("Invalid Refresh Token"));

    String newAccess = jwtUtils.generateToken(token.getUser());
    return new TokenResponse(newAccess, refreshToken);
}

Common Mistakes

Infinite Refresh: Allowing a refresh token to last forever. They should eventually expire, requiring a full login.
Exposing the token: Sending it in the JSON body of every response instead of using secure cookies.

Follow-up Questions

What is ‘Token Revocation’? (Answer: The ability to manually invalidate a token before its natural expiry, usually by deleting it from the server-side store).
OAuth2 Scopes: How do they relate? (Answer: Refresh tokens usually have a specific scope (offline_access) to allow background token renewal).

Expected Answer (PHP 8.5 / Laravel)

In PHP web applications, refresh tokens are used to extend sessions for JWT or API-based authentication (e.g., using Laravel Passport or Sanctum).

Laravel Passport: Provides full OAuth2 support, including refresh tokens out of the box.
Laravel Sanctum: Uses simple database-backed tokens. While it doesn’t use “Refresh Tokens” in the strict JWT sense, it allows issuing long-lived tokens that can be revoked.

Why It Matters

Refresh tokens are vital for SPAs (Single Page Applications) and mobile apps. They allow the app to securely store a long-lived credential (ideally in an HttpOnly cookie) to keep the user logged in without exposing their password repeatedly over the network.

Code Example

// Typical client-side flow with a PHP backend
// When Access Token expires (401 error)...
axios.post('/oauth/token', {
    grant_type: 'refresh_token',
    refresh_token: the_stored_refresh_token,
    client_id: '...',
    client_secret: '...'
}).then(response => {
    // Save new tokens
});

Common Mistakes

Storing refresh tokens in JavaScript state: They should be in secure cookies to prevent theft via XSS.
Not using HTTPS: Refresh tokens are powerful; if intercepted on an unencrypted connection, the attacker has full access to the user’s account.

Follow-up Questions

Sanctum vs Passport? (Answer: Sanctum is for simple token/session auth; Passport is for full OAuth2 compliance).
What is ‘Token Hashing’? (Answer: Storing a hash of the token in the database rather than the plain-text token, so that if the DB is leaked, the tokens are useless).