API Testing · Middle · Question 29 of 75
What should you test about refresh tokens?
- 1That they never expire, so users stay logged in forever
- 2That they can be used directly to call every endpoint
- 3They issue new access tokens, expire, and stop working when revoked
Show the answer
Correct answer: They issue new access tokens, expire, and stop working when revoked
Explanation
Also check rotation (old refresh token rejected after use) and logout revoking them.