Reply to thread

Message: <blockquote data-quote="JayC" data-source="post: 476783" data-attributes="member: 36373">This isn't the same though. Setting a token to never expire is a security concern. If the token is stolen or compromised, you could login impersonating that user (your server would never invalidate after a certain amount of time). With a refresh token can use their current auth token (before expiration) to regenerate a new token, with an expiration time.So you could set the expiration to be short (maybe just 12 hours) and then in the background you just refresh their token while their logged-in. On the same day, they would never need to refresh their credentials, but their authentication is validated.</blockquote>