<![CDATA[Is it sefe to get access to GET /api/jwt/refresh?userId={userId} method?]]>

<![CDATA[Is it sefe to get access to GET /api/jwt/refresh?userId={userId} method?]]>I can get all refresh tokens for user if I know the user id and API authorization key. Everybody can see authorization key. User id is data that never expires, can be stolen and does not have confidential character. Why do we have this method? I think it is easy way to get token for any user...

]]>https://fusionauth.io/community/forum/topic/101/is-it-sefe-to-get-access-to-get-api-jwt-refresh-userid-userid-methodRSS for NodeThu, 15 Oct 2026 07:38:30 GMTWed, 20 May 2020 23:29:14 GMT60<![CDATA[Reply to Is it sefe to get access to GET /api/jwt/refresh?userId={userId} method? on Thu, 21 May 2020 14:32:02 GMT]]>Hiya,

When you say

Everybody can see authorization key.

Who do you mean? Do you mean anyone with access to the FusionAuth admin console? Or some other set of users?

]]>https://fusionauth.io/community/forum/post/222https://fusionauth.io/community/forum/post/222Thu, 21 May 2020 14:32:02 GMT