System Design · Middle · Question 14 of 75
Why use a pair of access and refresh tokens?
- ✓Correct answer: A short-lived access token limits leak damage; refresh renews it
- 2Access is for reading and refresh is only for writing data
- 3A refresh token speeds up page loads through caching
Explanation
Access lives for minutes and is sent with every request; refresh lives longer, is stored more securely and is used only to obtain new access tokens. Refresh token rotation makes it possible to detect reuse of a stolen token.