🔐 What Are Refresh Tokens and How to Use Them Securely
Tags: security, token
Published: 2021-07-22 13:52:12

#### 📓 Learn about refresh tokens and how they help developers balance security and usability in their applications.

### <br>

This post will explore the concept of refresh tokens as defined by [OAuth 2.0](https://auth0.com/docs/protocols/protocol-oauth2). We will learn how they compare to other token types and how they let us balance security, usability, and privacy.

## What Is A Token?

Tokens are pieces of data that carry just enough information to facilitate the process of determining a user's identity or authorizing a user to perform an action. All in all, tokens are artifacts that allow application systems to perform the authorization and authentication process.

> New to identity concepts? Read [Authentication vs Authorization](https://auth0.com/intro-to-iam/authentication-vs-authorization/) to get started.

Common identity frameworks and protocols use token-based strategies to secure access to applications and resources. For example, we can use OAuth 2.0 for authorization and OIDC for authentication.

[OAuth 2.0](https://auth0.com/intro-to-iam/what-is-oauth-2/) is one of the most popular authorization frameworks out there. It is designed to allow an application to access resources hosted by other servers on behalf of a user. OAuth 2.0 uses **Access Tokens** and **Refresh Tokens**.

[OpenID Connect (OIDC)](https://auth0.com/intro-to-iam/what-is-openid-connect-oidc/) is an identity protocol that performs user authentication, user consent, and token issuance. OIDC uses **ID Tokens**.

<include src="ebook-ads/Oauth2OidcGuide" />

Let's explore the three token types that we use with OAuth 2.0 and OpenID Connect to fulfill the authentication and authorization processes of our application systems. In the process, we'll see the critical role that refresh tokens play in helping developers build applications that offer convenience without compromising security.

## Token Types

### What's an ID token?

As the name may suggest, an [ID token](https://auth0.com/docs/tokens/id-tokens) is an artifact that client applications can use to consume the identity of a user. For example, the ID token can contain information about the name, email, and profile picture of a user. As such, client applications can use the ID token to build a user profile to personalize the user experience.

An authentication server that conforms to the OpenID Connect (OIDC) protocol to implement the authentication process issues its clients an ID token whenever a user logs in. The consumers of ID tokens are mainly client applications such as Single-Page Applications (SPAs) and mobile applications. They are the intended audience.

### What's an access token?

When a user logins in, the authorization server issues an [access token](https://auth0.com/docs/tokens/access-tokens), which is an artifact that client applications can use to make secure calls to an API server. When a client application needs to access protected resources on a server on behalf of a user, the access token lets the client signal to the server that it has received authorization by the user to perform certain tasks or access certain resources.

OAuth 2.0 doesn't define a format for access tokens. At Auth0, for example, access tokens issued for the Management API and access tokens issued for any custom API that you have registered with Auth0 follow the [JSON Web Token (JWT) standard](https://jwt.io/). Their basic structure conforms to the typical JWT structure, and they contain standard JWT claims asserted about the token itself.

<include src="ebook-ads/JwtHandbook" />

This is the content of a decoded access token that follows the JWT format:

```json
{
  "iss": "https://YOUR_DOMAIN/",
  "sub": "auth0|123456",
  "aud": [
    "my-api-identifier",
    "https://YOUR_DOMAIN/userinfo"
  ],
  "azp": "YOUR_CLIENT_ID",
  "exp": 1489179954,
  "iat": 1489143954,
  "scope": "openid profile email address phone read:appointments"
}
```

It's important to highlight that the access token is a bearer token. Those who hold the token can use it. The access token then acts as a credential artifact to access protected resources rather than an identification artifact. Malicious users could theoretically compromise a system and steal access tokens, which in turn they could use to access protected resources by presenting those tokens directly to the server.

As such, it's critical to have security strategies that minimize the risk of compromising access tokens. One mitigation method is to create access tokens that have a short lifespan: they are only valid for a short time defined in terms of hours or days.

There are different ways that a client application can get a new access token for a user. For example, once an access token expires, the client application could prompt the user to log in again to get a new access token. Alternatively, the authorization server could issue a refresh token to the client application that lets it replace an expired access token with a new one.

> You can **see both ID tokens and access tokens in action** in any of our "Complete Guides to User Authentication" available for [React](https://auth0.com/blog/complete-guide-to-react-user-authentication/), [Angular](https://auth0.com/blog/complete-guide-to-angular-user-authentication/), [Vue](https://auth0.com/blog/complete-guide-to-vue-user-authentication/), and[ Node.js](https://auth0.com/blog/complete-guide-to-nodejs-express-user-authentication/)!

[Read more...](https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/?utm_source=content_synd&utm_medium=sc&utm_campaign=security)