I am trying to understand how (or if) we can update user profile changes like name, email, etc. on a JWT OAuth 2.0 Access Token issued during a refresh grant. Typically, it sounds like not only are these token immutable, but also during refresh grants none of the information, except iat, nbf, exp, etc. that pertain to the lifetime of the new token can be updated. Is this accurate? If so, how can I reflect user profile changes like name, etc. an ensure that the access token has accurate information?
Reflecting User Profile changes on an OAuth 2.0 Access Token
Viewed 104
1 Answers
The access token is immutable, but you're talking about issuing a new access token. I'm not aware of any specification which would limit the new access token to have the same claims as the old one.
Saying that you should remember that access tokens are not meant to carry information about the authenticated user, but rather an information that is needed to authorize requests. It might be better for you to implement a userinfo endpoint (as is used in the OpenID Connect standard), and read the profile data from that endpoint. That way you will be sure that the data returned from this endpoint is always fresh.
Related