Refresh token concept in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a refresh token in web authentication?

A refresh token is a special token used to get a new access token without asking the user to log in again. It helps keep users logged in smoothly.

beginner

Why do we use refresh tokens instead of long-lived access tokens?

Refresh tokens improve security by keeping access tokens short-lived. If an access token is stolen, it expires quickly, reducing risk.

intermediate

How does the refresh token flow work in Express apps?

When the access token expires, the client sends the refresh token to the server. The server verifies it and issues a new access token.

intermediate

Where should refresh tokens be stored on the client side?

Refresh tokens should be stored securely, often in HTTP-only cookies, to prevent access by JavaScript and reduce risk of theft.

advanced

What happens if a refresh token is compromised?

If a refresh token is stolen, an attacker can get new access tokens. To reduce risk, refresh tokens should be revocable and have expiration.

What is the main purpose of a refresh token?

A To encrypt the access token

B To replace the password

C To store user data

D To get a new access token without re-login

Refresh tokens allow clients to request new access tokens without asking the user to log in again.

Where is it safest to store a refresh token on the client?

A HTTP-only cookie

B Local storage

C Session storage

D In a JavaScript variable

HTTP-only cookies prevent JavaScript access, reducing risk of token theft.

What should happen when a refresh token is used to get a new access token?

A The server logs out the user

B The server verifies the refresh token and issues a new access token

C The client deletes the refresh token

D The client sends the password again

The server checks the refresh token's validity before issuing a new access token.

Why are access tokens usually short-lived?

A To save storage space

B To reduce server load

C To improve security by limiting token lifetime

D To speed up login

Short-lived tokens limit the time an attacker can use a stolen token.

What is a risk if refresh tokens are not revoked after logout?

A Attackers can use stolen refresh tokens to get new access tokens

B Passwords will be exposed

C The server will crash

D Users will stay logged in forever

Not revoking refresh tokens allows attackers to keep getting new access tokens.

Explain how refresh tokens help maintain user sessions securely in an Express app.

Think about how users stay logged in without re-entering passwords.

Describe best practices for storing and handling refresh tokens on the client and server.

Focus on security and preventing token theft.