Should I refresh access token on API

user_4981427 0
Viewed 141

There is a case when a specific authorized user changes his password or email. As email or password is part of user authentication, I think that it is necessary to revoke all auth tokens.

What is the best practice to refresh auth token in the case where a user has changed their password or email?

I do not use OAuth but have usual Bearer token in a header. The idea is to store on the client side an additional refresh token, every time the mail or password changes, we do revoke his access token. After this user can make a request with refresh token to get new access token

rest api authentication
1 Answers

Depending on your backend (Ruby on Rails, NodeJS, etc) there will be different approaches. This is an excellent blog post (warning: some colourful language used in that post) which goes over some authentication pitfalls, in particular resetting a password.

To be honest, are you sure you need to have a refresh token at all?

Why not simply issuing a new Bearer token using the updated credentials to the currently active session (the one that made the email/password change request)?

Case 1: authenticated session of user

User has active session(s) and updates their password or email from one of these sessions

  • invalidate the sessions that we're not used to update the password/email
  • no reason to assume the account has been hacked (they are already logged in, assuming you also expire your auth tokens in a reasonable time frame)
  • issue new Bearer token using updated credentials (password/email)
  • best practise: send an email to the account confirming the password change

Case 2: forgotten password

User is logged out and requests a password change (not that you asked for this specifically, but also why no refresh token is needed even if using a special session):

  • send the reset link
  • user clicks that link, which creates a special session where they are logged in and can update their password
  • user updates their password, invalidate all other sessions (if any), issue a new valid auth token to the current session based on updated credentials
  • best practise: force them to update the password before taking any other action

Hope this answers your question!

user_32495010
Related