Refresh tokens going stale
-
Will the refresh token go “stale” and be invalid if there is a set amount of time without any activity on a refresh token? Example:
Bob authenticates and obtains an authentication token as well as a refresh token. He does not use the refresh token for > 24 hours. When he attempts to use it to obtain a new authentication token, which will happen?
- He’ll get a new auth token via the refresh token since it’s expiry is 2 weeks
- He’ll have to reauthenticate because ??
-
This is configurable. Go to https://fusionauth.io/docs/v1/tech/core-concepts/tenants/#jwt (though the screencaps are a bit out of date) but you’ll go there in your instance.
You’ll see refresh token settings.
If you’re using a fixed expiration, then it never expires based on last usage, but just based upon time since it was issued.
If you’re using a sliding window expiration, then it will expire based upon the time since it was last used.
