Token refresh mechanism in Rest API - Mini Project: Build & Apply

Token Refresh Mechanism

📖 Scenario: You are building a simple REST API that uses tokens to allow users to access protected resources. Tokens expire after some time, so you need a way to refresh them without asking the user to log in again.

🎯 Goal: Create a token refresh mechanism that checks if the current token is expired and issues a new token if needed.

📋 What You'll Learn

Create a dictionary called tokens with user tokens and their expiry times

Create a variable called current_time representing the current time

Write a function called refresh_token that takes a user and refreshes the token if expired

Print the refreshed token or a message if the token is still valid

💡 Why This Matters

🌍 Real World

Token refresh mechanisms are used in apps and websites to keep users logged in securely without asking for passwords repeatedly.

💼 Career

Understanding token refresh is important for backend developers working on authentication and security in web services.

1

Create the initial tokens dictionary

Create a dictionary called tokens with these exact entries: 'alice': {'token': 'abc123', 'expiry': 100}, 'bob': {'token': 'def456', 'expiry': 200}, and 'carol': {'token': 'ghi789', 'expiry': 50}.

Rest API

# Create the tokens dictionary with user tokens and expiry times
# Your code here

Hint

Use a dictionary with usernames as keys and another dictionary as values holding 'token' and 'expiry'.

2

Set the current time

Create a variable called current_time and set it to 120 to represent the current time.

Rest API

tokens = {
    'alice': {'token': 'abc123', 'expiry': 100},
    'bob': {'token': 'def456', 'expiry': 200},
    'carol': {'token': 'ghi789', 'expiry': 50}
}
# Set the current_time variable to 120
# Your code here

Hint

Just assign the number 120 to the variable current_time.

3

Write the token refresh function

Write a function called refresh_token that takes a parameter user. Inside the function, check if tokens[user]['expiry'] is less than current_time. If yes, update tokens[user]['token'] to 'newtoken123' and tokens[user]['expiry'] to current_time + 100. Otherwise, do nothing.

Rest API

tokens = {
    'alice': {'token': 'abc123', 'expiry': 100},
    'bob': {'token': 'def456', 'expiry': 200},
    'carol': {'token': 'ghi789', 'expiry': 50}
}

current_time = 120

# Write the refresh_token function below
# Your code here

Hint

Use an if statement to compare expiry with current_time and update the token and expiry if expired.

4

Print the refreshed token

Call refresh_token for the user 'alice'. Then print the string "Refreshed token for alice: " followed by tokens['alice']['token'].

Rest API

tokens = {
    'alice': {'token': 'abc123', 'expiry': 100},
    'bob': {'token': 'def456', 'expiry': 200},
    'carol': {'token': 'ghi789', 'expiry': 50}
}

current_time = 120

def refresh_token(user):
    if tokens[user]['expiry'] < current_time:
        tokens[user]['token'] = 'newtoken123'
        tokens[user]['expiry'] = current_time + 100

# Call refresh_token for 'alice' and print the refreshed token
# Your code here

Hint

Call the function with 'alice' and print the message with the updated token.

Practice

1. What is the main purpose of a refresh token in a token refresh mechanism?

easy

A. To obtain a new access token without asking the user to log in again

B. To log out the user immediately

C. To store user passwords securely

D. To encrypt the access token

Solution

1. Step 1: Understand the role of refresh tokens

   Refresh tokens are used to get new access tokens when the old ones expire without requiring the user to log in again.

2. Step 2: Compare options with this role

   Only To obtain a new access token without asking the user to log in again describes this purpose correctly. Options A, C, and D describe unrelated or incorrect functions.

3. Final Answer:

   To obtain a new access token without asking the user to log in again -> Option A

4. Quick Check:

   Refresh token = renew access token without login [OK]

Hint: Refresh tokens renew access tokens silently [OK]

Common Mistakes:

• Confusing refresh token with access token
• Thinking refresh token logs out users
• Believing refresh token stores passwords

2. Which HTTP method is typically used by clients to send a refresh token to the server for a new access token?

easy

A. GET

B. PUT

C. POST

D. DELETE

Solution

1. Step 1: Identify the HTTP method for sending data securely

   POST is used to send data like refresh tokens in the request body securely to the server.

2. Step 2: Eliminate other methods

   GET is for retrieving data, DELETE for removing resources, and PUT for updating. Refresh token requests usually send sensitive data, so POST is preferred.

3. Final Answer:

   POST -> Option C

4. Quick Check:

   Send refresh token securely = POST [OK]

Hint: Use POST to send refresh tokens securely [OK]

Common Mistakes:

• Using GET which exposes tokens in URL
• Confusing PUT with POST
• Using DELETE which is for removal

3. Consider this simplified server response code snippet handling a refresh token request:

if refresh_token == valid_token:
    access_token = generate_new_token()
    return {"access_token": access_token, "status": 200}
else:
    return {"error": "Invalid refresh token", "status": 401}

What will be the output if refresh_token is invalid?

medium

A. {"access_token": "newtoken123", "status": 200}

B. {"error": "Invalid refresh token", "status": 401}

C. SyntaxError

D. {"status": 200}

Solution

1. Step 1: Analyze the condition for refresh token validity

   If the refresh token matches the valid token, a new access token is generated and returned with status 200.

2. Step 2: Check the else branch for invalid token

   If the token is invalid, the code returns an error message with status 401.

3. Final Answer:

   {"error": "Invalid refresh token", "status": 401} -> Option B

4. Quick Check:

   Invalid token returns error 401 [OK]

Hint: Invalid token triggers error response 401 [OK]

Common Mistakes:

• Assuming new token is returned even if invalid
• Confusing status codes 200 and 401
• Expecting syntax errors from valid code

4. A developer wrote this code to refresh tokens but it always returns an error:

def refresh_access_token(refresh_token):
    if refresh_token = valid_token:
        return generate_new_token()
    else:
        return "Invalid token"

What is the main error in this code?

medium

A. Function should not take parameters

B. Missing return statement in else block

C. generate_new_token() is undefined

D. Using assignment (=) instead of comparison (==) in the if condition

Solution

1. Step 1: Check the if condition syntax

   The code uses a single equals sign (=) which is assignment, not comparison. This causes a syntax error or logic error.

2. Step 2: Confirm other parts are correct

   The else block has a return statement, generate_new_token() is assumed defined, and function parameters are correct.

3. Final Answer:

   Using assignment (=) instead of comparison (==) in the if condition -> Option D

4. Quick Check:

   Use '==' to compare, not '=' [OK]

Hint: Use '==' for comparison in conditions [OK]

Common Mistakes:

• Confusing '=' with '==' in if statements
• Assuming missing return in else
• Thinking function parameters are wrong

5. You want to implement a token refresh endpoint that rejects refresh tokens if they are expired or revoked. Which approach best ensures security and proper token refresh?

hard

A. Store refresh tokens with expiration and revocation status; verify both before issuing new access tokens

B. Accept any refresh token and always issue a new access token

C. Only check if the refresh token exists in the database, ignore expiration

D. Issue new access tokens without any refresh token verification

Solution

1. Step 1: Understand security needs for refresh tokens

   Refresh tokens must be checked for expiration and revocation to prevent misuse and unauthorized access.

2. Step 2: Evaluate options for token verification

   Store refresh tokens with expiration and revocation status; verify both before issuing new access tokens includes both expiration and revocation checks, ensuring only valid tokens get new access tokens. Other options ignore important security checks.

3. Final Answer:

   Store refresh tokens with expiration and revocation status; verify both before issuing new access tokens -> Option A

4. Quick Check:

   Verify expiration and revocation for security [OK]

Hint: Check expiration and revocation before refresh [OK]

Common Mistakes:

• Ignoring token expiration
• Not checking if token is revoked
• Issuing tokens without verification