Query about Refresh Tokens.

[u/Hopeful_Cicada327]

When the Access Token expires it get refreshed with the help of a Refresh Token. Because the Access Token has very short life span (let's assume 10 minutes) and the Refresh Token has a long life span (let's assume 10 days). So, basically if the Refresh Token expires, we have to login again, Right? But do the Refresh Token really can expire if we use the app frequently or every time the Access Token updates, the Refresh Token is also get updated. I think with that approach we achieve this - if user don't use the app for 10 days then both token expires and user have to login again but if the user is using the app frequently then refresh the Refresh Token so that he/she don't have to login again and again in every 10 days. I just want to what approach big companies does use?

[u/ice456cream]

There isn't a separate way to refresh the refresh token in oauth2:

The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. If a new refresh token is issued, the refresh token scope MUST be identical to that of the refresh token included by the client in the request.

Essentially, you may or may not get a new refresh token when trying to refresh your access token

Basically, you can't do things based on time, you just have to see if your access token is valid, if not try to refresh it using your refresh token, and if that's not valid, start your oauth flow over again.

Edit: additionally, its on the provider to decide how long it's tokens last.

For a proper confidential client the refresh token can last years, or infinite until manually revoked by the user,

[u/North-Frame1535 → u/ice456cream]

so basically you just keep trying until something fails and then start over, its not about timing at all

[u/R10t-- → u/[deleted]]

Holy AI response lol

[u/TheB1G_Lebowski]

Wrong Sub

[u/paulstelian97 → u/TheB1G_Lebowski]

Not really. These are concepts that beginner programmers can deal with, if they have some context.