intermediate~2h
Refresh Tokens & Session Lifecycle
Module 13's access token expires in 15 minutes on purpose. This module is what happens next, without forcing your user to log in again every quarter hour.
Learning objectives
- Beginner: Explain why a short-lived access token is paired with a separate, longer-lived refresh token instead of one long-lived token.
- Intermediate: Implement a refresh endpoint that issues a new access token without forcing re-authentication.
- Advanced: Design refresh token storage and revocation so a stolen refresh token can be detected and invalidated.
This is a Pro chapter
Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.
Refresh Tokens & Session Lifecycle