OIDC standard response if grant_type of refresh_token

user_3094034 0
Viewed 20

Currently I am using /token endpoint to obtain an access token, an ID token (by including the openid+offline_access scope), and a refresh token for the Authorization Code flow. The value for code is the authorization code that I receive in the response from the request to the /authorize endpoint.

Also to refresh access token as well as an ID token, I am sending a token request with a grant_type of refresh_token.

Below is the reference link, I am trying similar to implement in my custom OIDC application. https://developer.okta.com/docs/guides/refresh-tokens/main/#renew-access-and-id-tokens-with-spas

Does it suppose to return both refresh_token and id_token OR both are optional if grant_type=refresh_token (also in token endpoint openid+offline_access scope added) in OpenID Connect concept?

Below is the link I am trying to understand.

https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens

oauth-2.0 openid-connect authorization
1 Answers

When you use the refresh token, the purpose is to get a new access token. Optionally, depending on the backend configuration, you might get a new refresh token as well (if you use a one-time refresh token setup).

You never get a new ID-token back, the ID token is usually a very short-lived token (like 5 minutes) and its main purpose is to describe how the user is authenticated and who it is. The main purpose of the ID token is to create the local session (typically a session cookie), after that the ID token has no real use.

Andy_684900
Related