What is the difference between using refresh token and Silent Authentication for SPA?

user_1602742 0
Viewed 9540

As I understand you must not issue a refresh token for SPA. But there are options to get a new access token like silent authentication.

To make things simple, you supply a refresh token to the Authorization Server(AS) and get a new access token. With silent authentication you pass current access token to some endpoint on the AS and if it is valid you get a new access token.

So please correct me, because I do not understand why silent authentication is more secure approach.

oauth-2.0 authorization oauth authentication
1 Answers

With silent authentication you pass current access token to some endpoint on the AS and if it is valid you get a new access token.

That's not correct.

The flow with silent authentication looks like this:

Auth Server (AS) and Client (SPA)

  • SPA redirects user to log in with AS.
  • AS logs user in and redirects back to the SPA with an access token that can be used to access an API
  • SPA calls API until it gets 401. (or uses some other mechanism to figure out time to get new access token)
  • SPA does a silent GET to the AS authorize endpoint in attempt to get new access token. It does not need to supply old expired access token.
  • IF AND ONLY user still has a valid session with AS (some sort of auth cookie likely) then AS will respond with valid access token (if AS believes the request is valid).

The good article explaining silent authentication

For the why to prefer auth cookie vs refresh token - this question clarifies that.

user_11816210
Related