AccessToken and RefreshToken

Token-based authentication is a security method where a unique token is generated and exchanged between a user and a system for authentication purposes. Instead of relying on traditional username and password credentials, tokens are utilised to grant access. Often time-limited and dynamically generated tokens enhance security by reducing the risk of unauthorised access. Popular implementations include JSON Web Tokens (JWT) and OAuth, providing a secure and efficient means of validating user identity in various online platforms and applications.

Here, we discuss about the JSON Web Tokens.

JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims between two parties. Widely used in authentication and authorization protocols, JWTs consist of encoded JSON objects, signed to ensure integrity. They consist of three parts: a header specifying the signing algorithm, a payload containing claims, and a signature ensuring data integrity. JWTs facilitate secure data transmission and are commonly employed in web applications to validate the authenticity of users and authorize their access.

An Access token is a type of credential used in authentication protocols. It is a string that represents the authorization granted by the backend, typically after a user successfully authenticates.

It is stored only on the client side. Access tokens are sent by the client to access protected resources on behalf of the user. They serve as proof of authorization and are commonly used in web and mobile applications to enable secure and controlled access to APIs, services, or other protected resources.

Access tokens are short-lived tokens. So, After the token expires user needs to log in again. This problem is solved by Refresh tokens.

A refresh token is part of the OAuth 2.0 authentication protocol and is used to obtain a new access token. After a user has successfully authenticated and received an access token, a refresh token is issued alongside it. While access tokens have a limited lifespan, refresh tokens are long-lived and can be used to obtain a new access token without requiring the user to re-enter their credentials.

The refresh token is saved on both the client and the server side. When the Access token expires the client hits an endpoint and sends the refresh token to the backend. The backend matches the token which the client sends and the token stored in the server. If the token matches the backend generates a new access token and provides the client.

This mechanism enhances security by reducing the frequency of user logins and is commonly employed in scenarios where long-term access is necessary, such as in mobile and web applications.

Refer below videos for a better understanding with Javascript and JWT.