Web Security · Middle · Question 45 of 75
Why are access tokens usually short-lived (minutes) while refresh tokens live longer?
- ✓Correct answer: A leaked access token is useful only briefly, and refresh tokens can be stored and checked more strictly
- 2Because short tokens are smaller
- 3Because browsers delete tokens after 15 minutes
Explanation
Access tokens travel to many APIs and are easier to leak. Refresh tokens go only to the auth server, where they can be revoked.