I am using Keycloak and Oauth2 to secure my website and the problem here is that the user is deleted but can still keep logged in until his access token is expired. If I reduce the access token lifespan, the user needs to re-login very often. So what I am thinking, I need to reduce the lifespan of the access token but should make it refreshed automatically with the refresh token. The user won't notice that the access token is regularly refreshed, but if the user is deleted, the token refresh would fail and the user would be logged out immediately. Is there any standard paradigm for this kind of flow?
0 Answers
Related