Token refresh mechanism in Rest API - Step-by-Step Execution

Concept Flow - Token refresh mechanism

Client sends login request

↓

Server validates credentials

↓

Server issues Access Token + Refresh Token

↓

Client uses Access Token for API calls

↓

Access Token expires?

No→Continue using API

Yes↓

Client sends Refresh Token to server

↓

Server validates Refresh Token

↓

Server issues new Access Token (and optionally new Refresh Token)

↓

Client uses new Access Token

↓

Repeat cycle

This flow shows how a client uses a refresh token to get a new access token when the old one expires, keeping the session alive without re-login.

Execution Sample

Rest API

POST /login
Response: {"access_token": "abc", "refresh_token": "xyz"}

Use access_token for API calls

If access_token expired:
POST /refresh with refresh_token
Response: {"access_token": "new_abc"}

Client logs in, receives tokens, uses access token, and refreshes it when expired using refresh token.

Execution Table

Step	Action	Input	Server Response	Client State
1	Client sends login request	username/password	Valid credentials	No tokens
2	Server issues tokens	-	{"access_token": "abc", "refresh_token": "xyz"}	Received tokens
3	Client calls API with access_token	access_token='abc'	200 OK	Access token valid
4	Access token expires	Time passes	401 Unauthorized	Access token expired
5	Client sends refresh request	refresh_token='xyz'	Valid refresh token	Refresh token valid
6	Server issues new access token	-	{"access_token": "new_abc"}	Updated access token
7	Client calls API with new access_token	access_token='new_abc'	200 OK	Access token valid
8	Refresh token invalid or expired	refresh_token='xyz'	401 Unauthorized	Must re-login
9	Client logs in again	username/password	Valid credentials	No tokens
10	Server issues new tokens	-	{"access_token": "abc2", "refresh_token": "xyz2"}	Received new tokens

💡 Process repeats until refresh token expires or is invalid, then user must log in again.

Variable Tracker

Variable	Start	After Step 2	After Step 6	After Step 10
access_token	None	"abc"	"new_abc"	"abc2"
refresh_token	None	"xyz"	"xyz"	"xyz2"
token_validity	N/A	Valid	Valid	Valid

Key Moments - 3 Insights

Why does the client need to send the refresh token after the access token expires?

Because the access token is short-lived for security, the refresh token lets the client get a new access token without logging in again, as shown in steps 4 to 6 in the execution_table.

What happens if the refresh token is invalid or expired?

The server responds with 401 Unauthorized (step 8), forcing the client to log in again to get new tokens, as shown in steps 9 and 10.

Does the refresh token change every time a new access token is issued?

Not always. Sometimes the server issues a new refresh token with the new access token (step 10), but often it remains the same (step 6). This depends on server policy.

Visual Quiz - 3 Questions

Look at the execution_table, what is the client state after step 6?

A Access token expired

B No tokens

C Updated access token

D Must re-login

💡 Hint

Check the 'Client State' column for step 6 in the execution_table.

At which step does the server respond with 401 Unauthorized due to expired access token?

A Step 3

B Step 4

C Step 5

D Step 8

💡 Hint

Look for '401 Unauthorized' in the 'Server Response' column in the execution_table.

If the refresh token expires, what must the client do next according to the execution flow?

A Log in again to get new tokens

B Continue using expired access token

C Send the same refresh token again

D Ignore tokens and call API

💡 Hint

Refer to steps 8 to 10 in the execution_table and client state changes.

Concept Snapshot

Token refresh mechanism:
- Client gets access + refresh tokens on login
- Access token used for API calls, short-lived
- When access token expires, client sends refresh token
- Server validates refresh token and issues new access token
- If refresh token invalid, client must log in again
- Keeps user logged in without frequent re-authentication

Full Transcript

The token refresh mechanism helps keep a user logged in securely. First, the client logs in and receives an access token and a refresh token. The access token is used to call APIs but expires quickly. When it expires, the client sends the refresh token to the server. The server checks if the refresh token is valid and then sends a new access token. This cycle repeats, allowing the client to stay logged in without asking the user to enter credentials again. If the refresh token expires or is invalid, the client must log in again to get new tokens. This process balances security and convenience.

Practice

1. What is the main purpose of a refresh token in a token refresh mechanism?

easy

A. To obtain a new access token without asking the user to log in again

B. To log out the user immediately

C. To store user passwords securely

D. To encrypt the access token

Solution

1. Step 1: Understand the role of refresh tokens

   Refresh tokens are used to get new access tokens when the old ones expire without requiring the user to log in again.

2. Step 2: Compare options with this role

   Only To obtain a new access token without asking the user to log in again describes this purpose correctly. Options A, C, and D describe unrelated or incorrect functions.

3. Final Answer:

   To obtain a new access token without asking the user to log in again -> Option A

4. Quick Check:

   Refresh token = renew access token without login [OK]

Hint: Refresh tokens renew access tokens silently [OK]

Common Mistakes:

• Confusing refresh token with access token
• Thinking refresh token logs out users
• Believing refresh token stores passwords

2. Which HTTP method is typically used by clients to send a refresh token to the server for a new access token?

easy

A. GET

B. PUT

C. POST

D. DELETE

Solution

1. Step 1: Identify the HTTP method for sending data securely

   POST is used to send data like refresh tokens in the request body securely to the server.

2. Step 2: Eliminate other methods

   GET is for retrieving data, DELETE for removing resources, and PUT for updating. Refresh token requests usually send sensitive data, so POST is preferred.

3. Final Answer:

   POST -> Option C

4. Quick Check:

   Send refresh token securely = POST [OK]

Hint: Use POST to send refresh tokens securely [OK]

Common Mistakes:

• Using GET which exposes tokens in URL
• Confusing PUT with POST
• Using DELETE which is for removal

3. Consider this simplified server response code snippet handling a refresh token request:

if refresh_token == valid_token:
    access_token = generate_new_token()
    return {"access_token": access_token, "status": 200}
else:
    return {"error": "Invalid refresh token", "status": 401}

What will be the output if refresh_token is invalid?

medium

A. {"access_token": "newtoken123", "status": 200}

B. {"error": "Invalid refresh token", "status": 401}

C. SyntaxError

D. {"status": 200}

Solution

1. Step 1: Analyze the condition for refresh token validity

   If the refresh token matches the valid token, a new access token is generated and returned with status 200.

2. Step 2: Check the else branch for invalid token

   If the token is invalid, the code returns an error message with status 401.

3. Final Answer:

   {"error": "Invalid refresh token", "status": 401} -> Option B

4. Quick Check:

   Invalid token returns error 401 [OK]

Hint: Invalid token triggers error response 401 [OK]

Common Mistakes:

• Assuming new token is returned even if invalid
• Confusing status codes 200 and 401
• Expecting syntax errors from valid code

4. A developer wrote this code to refresh tokens but it always returns an error:

def refresh_access_token(refresh_token):
    if refresh_token = valid_token:
        return generate_new_token()
    else:
        return "Invalid token"

What is the main error in this code?

medium

A. Function should not take parameters

B. Missing return statement in else block

C. generate_new_token() is undefined

D. Using assignment (=) instead of comparison (==) in the if condition

Solution

1. Step 1: Check the if condition syntax

   The code uses a single equals sign (=) which is assignment, not comparison. This causes a syntax error or logic error.

2. Step 2: Confirm other parts are correct

   The else block has a return statement, generate_new_token() is assumed defined, and function parameters are correct.

3. Final Answer:

   Using assignment (=) instead of comparison (==) in the if condition -> Option D

4. Quick Check:

   Use '==' to compare, not '=' [OK]

Hint: Use '==' for comparison in conditions [OK]

Common Mistakes:

• Confusing '=' with '==' in if statements
• Assuming missing return in else
• Thinking function parameters are wrong

5. You want to implement a token refresh endpoint that rejects refresh tokens if they are expired or revoked. Which approach best ensures security and proper token refresh?

hard

A. Store refresh tokens with expiration and revocation status; verify both before issuing new access tokens

B. Accept any refresh token and always issue a new access token

C. Only check if the refresh token exists in the database, ignore expiration

D. Issue new access tokens without any refresh token verification

Solution

1. Step 1: Understand security needs for refresh tokens

   Refresh tokens must be checked for expiration and revocation to prevent misuse and unauthorized access.

2. Step 2: Evaluate options for token verification

   Store refresh tokens with expiration and revocation status; verify both before issuing new access tokens includes both expiration and revocation checks, ensuring only valid tokens get new access tokens. Other options ignore important security checks.

3. Final Answer:

   Store refresh tokens with expiration and revocation status; verify both before issuing new access tokens -> Option A

4. Quick Check:

   Verify expiration and revocation for security [OK]

Hint: Check expiration and revocation before refresh [OK]

Common Mistakes:

• Ignoring token expiration
• Not checking if token is revoked
• Issuing tokens without verification