I am currently working on an API with django rest framework, and I have a question about token (JWT or OAuth2) authentication.
Actually I have a doubt about the utility of a long-lived refresh token when the authentication server and the resource server are the same.
What I understand about refresh token is that when a user authenticate, the authentication server send in return a short-lived access token and a long-lived refresh token that we store.
When the user interact with the resource server we send the access token in the request and never the refresh token. And if the access token has expired, we ask for a new access token sending the refresh token to the authentication server.
By this way if the attacker get the access token, he will have a short window to use it because it is short lived.
But in the case of authentication server = resource server, if the attacker can compromise the access token, he can compromise the refresh token too. And he can get new access token easily, am I right ?
So what is the purpose of using a refresh token system in this case (authentication server = resource server) ? In my opinion this is the same as set a long-lived access token, but I'm not sure...
Thank you